Unlawful Cookie Banners: Belgian DPA let news outlets buy themselves free from GDPR compliance
Belgian news outlets relying on illegal cookie banners paid € 10.000 in a settlement with the Belgian Data Protection Authority (DPA), which decided to close the case without ordering them to fix the unlawful banners. In essence, the payment was freeing the companies from the duty to comply with the GDPR. noyb files 15 complaints against said news sites to force them to fix their cookie banners
Questionable settlement. Today, noyb lodged complaints against 15 Belgian news sites using deceptive cookie banners with the Belgian DPA. Among them are large TV channels like RTL Belgium, the public service broadcaster VRT, but also newspapers like Het Laatste Nieuws and L’Avenir. Although their websites already were subject of a DPA investigation in the past years, they were never ordered to change their unlawful cookie banners. The reason: The procedure was closed with a questionable settlement.
Bought free from the GDPR. According to the terms of said settlement, the publishers agreed to paying € 10.000 – but weren’t ordered to comply with any of the obligations under the GDPR. In its decision, the Belgian DPA didn’t even bother to explain why the cases were settled and not followed by an order to comply.
Felix Mikolasch, data protection lawyer at noyb: “It seems that in Belgium you can just pay a fee to avoid compliance with the GDPR. This is not compliant with EU law, which requires proper enforcement of the law."
Minimum requirements. noyb already filed hundreds of complaints against websites using deceptive cookie banners, forcing the European Data Protection Board (EDPB) to create a task force to coordinate how these complaints should be addressed. In January 2023, it issued a report in which the EU regulators agreed on a minimum requirement for the design of cookie banners. Many national DPAs have since issued guidelines that go far beyond the EDPB requirements, such as Spain and France.
No proper enforcement. Despite the EDPB report, the news sites affected by today's complaints still don’t fulfill the bare minimum requirement for a cookie banner, for example a “reject all” button or an easy way to withdraw previously given consent. A full list of the websites against which a complaint has been filed can be found here.
Lisa Steinfeld, legal trainee at noyb: “We are shocked that despite the clarity of the cookie requirements to date, the concerned news sites still don’t respect the basic principles for designing cookie banners. Respecting the privacy of their users is especially important considering these websites have a lot of visitors.”
Necessary actions. noyb’s complaints will require the Belgian DPA to investigate the cases once again and order the 15 news sites to change their unlawful cookie banners. In case of non-compliance, the DPA can issue a fine of up to 4 percent of the annual turnover of the companies behind the websites.
