Europe’s top court rules that IAB Europe is responsible under the GDPR for the “TCF” consent spam popups that appear on almost every website.