That said, I don't understand how TC String can be considered PII.
I haven't been following this case so probably miss a lot of context, but my understanding is that the TC String encodes user's preferences for which advertises to share your info with. For example, I visit example.com and deselect everything. This information then gets passed around so that advertisers know I don't want their advertising.
Isn't that kind of the point? I want them to know I don't want them. I'd rather setup that once and then not do it again for every site under the sun. Is the issue here that you can somehow be identified based on your tracking preferences alone?
The ruling here is confirmation of an earlier ruling where TC String was considered personal data. As an effect, the organization coordinating all this tracking (IAB) is considered data processor.
Is the ruling just a technicality (the fine is pretty low) because IAB isn't listed in data processor lists for all the sites I visit, or is there a deeper consequence arising from the ruling?