During a recent working group call with privacy officers from Belgium, Austria, and the Netherlands, a pressing issue emerged. The EDPB's 28 May 2026 binding decision under Art.65(1)(a) General Data Protection Regulation about the VRT cookie banner complaint had just been released. Everyone wanted to understand its impact on cross-border complaint handling.
The decision is clear: the EDPB instructed the Belgian DPA to assess NOYB's complaint about VRT's cookie banners rather than dismiss it on procedural grounds. This decision affects every organization managing cross-border data processing and every privacy team trying to predict complaint handling outcomes.
Here's what you need to know.
Can Our DPA Still Dismiss Complaints for "Abuse of Process"?
They can try, but it's now much harder.
The EDPB applied the CJEU's abuse test, which requires proving both an objective and subjective intent to abuse the process. The Belgian DPA failed to demonstrate this in the VRT case.
Your DPA can't dismiss a complaint just because it's part of a coordinated campaign or filed by an advocacy group. NOYB filed the complaint under Art.80(1) GDPR, which allows not-for-profit bodies to represent data subjects. Using that right isn't abuse.
If you're defending against a complaint, focus on the substantive compliance questions instead of arguing for dismissal based on the complainant's history or NGO involvement.
Does This Mean Every Cookie Banner Complaint Will Get a Full Investigation?
Not automatically, but procedural shortcuts are now riskier for DPAs.
The EDPB instructed the Belgian DPA to assess the complaint on its merits and submit a new draft decision to Concerned Supervisory Authorities under Art.60(3) GDPR. This triggers the full cooperation mechanism, allowing other DPAs to weigh in and potentially raise objections.
For your organization, this changes the risk calculation. A complaint that might have been dismissed could now lead to a binding decision affecting your entire EU operation. The Belgian DPA is the Lead Supervisory Authority because VRT's main establishment is in Belgium, but the Austrian DPA's objection escalated the dispute to the EDPB.
Map which DPA would serve as your LSA for different processing activities. If you're relying on a particular DPA's lenient interpretation of cookie consent requirements, understand that Concerned Supervisory Authorities can enforce stricter assessments.
What Counts as a "Relevant and Reasoned Objection" That Forces EDPB Escalation?
The Austrian DPA's objection met the Art.4(24) GDPR standard by demonstrating a clear risk to fundamental rights and freedoms or the free flow of personal data.
The objection argued that dismissing the complaint without assessing the actual cookie banner practices would fail to protect data subjects' rights under Art.7 GDPR (conditions for consent) and Art.21 GDPR (right to object). The EDPB agreed it was both relevant and reasoned.
For privacy officers, this matters when predicting whether a draft decision will stick or get escalated. If your LSA proposes a decision that another DPA could argue undermines fundamental rights protection, expect objections. The EDPB has guidelines on relevant and reasoned objections that outline the criteria.
How Should We Adjust Our Cross-Border Complaint Response Strategy?
Stop treating the LSA as your only audience.
When responding to a complaint or cooperating with an investigation, remember that Concerned Supervisory Authorities will review the draft decision. If your arguments rely on narrow procedural interpretations or assume the LSA will be lenient, you're vulnerable to objections from stricter DPAs.
Build your response around the substantive compliance question. In the VRT case, that's whether the cookie banners meet the consent requirements in Art.7 GDPR and the ePrivacy Directive. Document your legal basis clearly, show how you've implemented technical and organizational measures, and consider the EDPB's guidance on consent and cookies.
Don't assume an initial procedural dismissal ends the matter. The VRT case shows that even if your LSA dismisses a complaint, the EDPB can require a full merits assessment later. Prepare a substantive defense from the start.
What Does This Mean for Our Consent Management Platform Configuration?
The EDPB hasn't ruled on VRT's actual cookie practices yet, but the decision signals that consent implementation will face serious scrutiny.
When the Belgian DPA assesses the merits, they'll evaluate whether VRT's banners meet Art.7 GDPR requirements: freely given, specific, informed, and unambiguous consent. The EDPB's guidelines require that rejecting cookies must be as easy as accepting them, pre-ticked boxes don't constitute consent, and cookie walls generally violate the "freely given" requirement.
Review your Consent Management Platform settings now. Can users reject all non-essential cookies with a single click? Do you clearly distinguish essential cookies from analytics, advertising, and social media cookies? Are you blocking cookie deployment until consent is obtained, or just showing a banner while cookies load?
The VRT decision doesn't create new consent requirements, but it shows the EDPB will require DPAs to enforce existing requirements substantively.
Should We Expect More EDPB Binding Decisions on Complaints?
Yes, especially where DPAs disagree on enforcement priorities.
Art.65(1)(a) GDPR resolves disputes between the LSA and CSAs in cross-border cases. It ensures consistent GDPR application across member states when supervisory authorities can't reach consensus.
The VRT decision is one example, but this pattern will repeat where DPAs have different enforcement philosophies. Some prioritize substantive rights protection; others prefer procedural efficiency. When those approaches collide, the EDPB steps in.
For organizations with establishments in multiple member states, this creates both risk and opportunity. A complaint filed in one country can trigger enforcement across your entire EU operation if the EDPB issues a binding decision. EDPB decisions create clearer precedent than individual DPA rulings, providing better guidance on implementing controls consistently.
Where Should We Look for Updates on the VRT Case and Similar Disputes?
The EDPB publishes binding decisions on its website, often with redactions to protect commercially sensitive information. The Belgian DPA must submit a new draft decision assessing VRT's cookie banners on the merits under Art.60(3) GDPR.
Watch for that draft decision and any subsequent objections from Concerned Supervisory Authorities. If the case returns to the EDPB for another binding decision on substantive compliance questions, you'll get detailed guidance on cookie consent requirements that applies across all member states.
Also monitor NOYB's website. They publish updates on their strategic litigation, including complaints against organizations using similar cookie banner patterns. If your consent implementation resembles the practices they're challenging, expect similar scrutiny.
The key takeaway: procedural dismissals won't shield you from substantive compliance obligations. Build your data protection program to withstand a full merits assessment, because that's increasingly what you'll face.
