European Data Protection Board

What the regulator decided

The notions of controller and processor are functional - they aim to allocate responsibilities according to the actual roles of the parties. A controller is the body which "determines the purposes and means" of the processing; a processor processes "on behalf of the controller". Where an entity defines what data is collected, for what purpose, with whom it is shared and for how long, it acts as a controller regardless of its self-description.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

[Type: guidance] Non-enforcement guideline. Cite when the scanner narrative covers a vendor (analytics, tag-management, email-tracking) that self-classifies as Article 28 processor while in fact determining the purposes of processing - the AEPD Mailtrack PS-00388-2022 decision applies this guideline directly.