The rammifications of GDPR just keep rolling up the adverse.

Link to decision (en français):
* Décision n° MED 2018-042 du 30 octobre 2018 mettant en demeure la société VECTAURY [legifrance.gouv.fr], Décision n°MED-2018-042 du 30 octobre 2018.

Link to deliberation on decision in Part 1 (en français):
* Délibération n°2018-343 du 8 novembre 2018 [legifrance.gouv.fr], décidant de rendre publique la mise en demeure n°MED-2018-042 du 30 octobre 2018 prise à l’encontre de la société VECTAURY

Note: Apparently quoting the decision, in whole, in English, exceeds WebmasterWorld post limits. Rather than my picking and choosing bits to quote I recommend that one simply have Google translate the two pages in question as the reasoning is an important to understanding.

There were other factors at play, however the kicker that has so many so upset, so scrambling or so joyous, depending on mindset and employer is that consent can not be passed simply via contract. This upsets a good many, perhaps all third party adtech frameworks.

For those who can't be bothered:
* French decision could remake adtech [techcrunch.com] by Natasha Lomas, 20-November-2018.
* French regulator shows flaws in IAB’s consent framework [brave.com] by Johnny Ryan, 20-November-2018.