Volume 14, Issue 3 Are internet standard developing organisations data controllers under the GDPR? Julien Rossi, Université Paris 8Jonathan Keller, CNRS PUBLISHED ON: 15 Sep 2025 DOI: 10.14763/2025.3.2034 What does a recent decision by the European Union’s Court of Justice – ruling that IAB Europe is liable under the GDPR for a technical standard it wrote – mean for internet standard-setting organisations? KEYWORDS: Data protection, GDPR, Data controller, Technical standardisation, EU law