Summary

• The EDPB has issued a binding decision requiring the Belgian DPA to assess a NOYB cookie banner complaint on its merits.
• The dispute concerns VRT, Belgium’s public broadcaster, and the handling of consent complaints under GDPR.
• The decision reinforces the importance of substantive enforcement in a market still shaped by consent banners, tracking, and adtech compliance.

The European Data Protection Board has told Belgium’s data protection authority to assess a NOYB cookie banner complaint on its merits rather than dismissing it on procedural grounds.

The binding decision concerns a complaint against Vlaamse Radio-en Televisieomroeporganisatie, the Belgian public broadcaster known as VRT. NOYB lodged the complaint with the Austrian data protection authority on behalf of an individual, challenging the use of cookie banners on VRT’s website.

Belgium’s data protection authority, acting as lead supervisory authority, had proposed dismissing the complaint on the basis of alleged abuse of GDPR complaint rights. Austria objected, arguing that the case should receive a substantive decision. Because the Belgian authority did not follow that objection, the dispute was escalated to the EDPB under the GDPR’s cooperation and consistency mechanism.

The EDPB found that the available information did not demonstrate the objective and subjective components needed to establish abuse. It instructed the Belgian authority to assess the complaint on its merits and submit a new draft decision to the concerned supervisory authorities.

The dispute is narrow, but it sits inside a much larger enforcement problem. Consent interfaces remain one of the main ways European users encounter the GDPR in practice, and one of the main mechanisms through which publishers, advertisers, platforms, and consent management providers justify tracking and targeted advertising.

Years after the GDPR came into force, enforcement around cookie banners still varies between countries. Some authorities have taken a tougher line on reject buttons, dark patterns, and consent design, while others have moved more slowly or handled complaints in ways that campaign groups argue weaken the law. That unevenness matters because digital advertising and analytics systems operate across borders, and inconsistent enforcement can create uneven compliance costs.

The EDPB has not decided whether VRT’s cookie banner breached the GDPR. Instead, it has addressed whether the complaint could be set aside without a substantive decision. Procedure can be commercially important in data protection because it shapes enforcement risk before any final ruling on legality. If complaints are more likely to be assessed on the merits, organisations relying on consent banners face greater pressure to defend the actual design and operation of those interfaces.

Publishers and media organisations sit under particular pressure. Advertising revenue, analytics, audience segmentation, and subscription conversion often depend on tracking systems that require valid consent. At the same time, regulators and privacy groups continue to challenge designs that make refusal harder than acceptance or obscure the consequences of consent.

Technology suppliers are also implicated. Consent management platforms have become a compliance layer for thousands of sites, but responsibility does not disappear because a banner is outsourced. Website operators still need to understand what data is collected, which vendors receive it, and whether the interface gives users a genuine choice.

The decision reinforces a familiar direction in European privacy law: formal compliance mechanisms are being tested against real user experience. A banner’s existence does not prove that consent is freely given, specific, informed, and unambiguous. A procedural dismissal does not create regulatory certainty.

As the Belgian authority revisits the complaint, the final outcome may still turn on the details of VRT’s implementation. The EDPB has already sent a signal to supervisory authorities: cross border GDPR complaints cannot be drained of effect through procedural narrowing where abuse has not been demonstrated. Advertisers, publishers, platforms, and the vendors that sell consent infrastructure into Europe’s digital economy will be watching the next draft decision closely.