Consent Management Platforms Under the GDPR: Processors and/or Controllers?

Consent Management Providers (CMPs) provide consent pop-ups that are embedded in ever more websites over time to enable streamlined compliance with the legal requirements for mandated by ePrivacy Directive and General Data Protection Regulation (GDPR). They implement standard collection from Transparency Framework (TCF) (current version v2.0) proposed European branch of Interactive Advertising Bureau (IAB Europe). Although IAB’s TCF specifications characterize CMPs as data processors, factual activities often qualifies them controllers instead. Discerning their clear role is crucial since obligations liability depend on accurate characterization. We perform empirical experiments two major CMP providers EU: Quantcast OneTrust paired a analysis. conclude process personal data, we identify multiple scenarios wherein controllers.