> That said, I don't understand how TC String can be considered PII. IANAL (or even Belgian). There wasn't a direct ruling on if TC strings itself were PII. T

> That said, I don't understand how TC String can be considered PII. IANAL (or even Belgian). There wasn't a direct ruling on if TC strings itself were PII. They were personal data that can be linked to individual since CMP will get both the IP address and the TC string. As for IAB being (joint) data controller, the reason (sections 68 to 80) given for that is that they determine purpose and means of processing. They might not hold any data, but they set the rules for the framework.