Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
EDPB / EDPS July 14, 2026 7 min

EDPB binding decision 1/2026: a cookie complaint cannot be dismissed by claiming the complainant is abusing their rights

Published on 14 July 2026, the decision of 28 May 2026 under Art. 65(1)(a) GDPR: the Belgian DPA must decide on the merits the noyb complaint against public broadcaster VRT

TL;DR for the DPO

If a client receives a complaint and the temptation is to answer 'this is a serial complaint, there is no real interest', this decision shows that road is narrow: abuse of rights must be proven in two components, objective and subjective, under the CJEU test. If you cannot prove them, the complaint must be examined on the merits.

What happened

The complaint was lodged with the Austrian DPA by the NGO noyb on behalf of an individual and concerned the cookie banners on the website of Vlaamse Radio- en Televisieomroeporganisatie (VRT), the Belgian public broadcaster. The Belgian DPA, acting as Lead Supervisory Authority, submitted a draft decision dismissing the complaint on the basis of an alleged abuse of Art. 77 and Art. 80(1) GDPR. The Austrian DPA, as Concerned Supervisory Authority, objected: the complaint should not have been dismissed on procedural grounds but decided on the merits. The lead authority chose not to follow the objection and referred the case to the EDPB.

What the EDPB decided

The EDPB considered the Austrian objection relevant and reasoned within the meaning of Art. 4(24) GDPR and in line with its Guidelines 09/2020, and assessed it on the merits. On the basis of the information available and applying the CJEU test for alleged abuse, it concluded that the complainant did not abuse their rights under Art. 77 and Art. 80(1): neither the objective nor the subjective component needed to prove abuse was demonstrated. It therefore instructed the lead authority not to dismiss the complaint, to assess it on its merits and to submit a new draft decision to the concerned authorities under Art. 60(3).

Why this matters to a DPO

  • Dismissal for abuse of rights is not a shortcut: two components must be proven, it is not a matter of expediency
  • The fact that a complaint arrives through a body under Art. 80(1) does not make it abusive in itself
  • Art. 65 is a dispute resolution mechanism between the lead and the concerned authorities: in cross-border cases the decision of the authority in the controller's country is not the last word
  • The case started from a cookie banner: the topic remains under scrutiny across Europe

What I would do with clients

  • In the complaint-handling procedure, remove any wording such as 'vexatious complaint' as a ground for closing: if you use it, it must be documented with the two elements of abuse
  • If a client has a cookie banner where refusing costs more than accepting, that is another signal this is not a quiet area
  • If the client is a group with its main establishment in another Member State, explain that the lead authority can be overruled: the merits must be assessed from the start
Official source:EDPB - Comunicato del 14 luglio 2026Official source:EDPB - Binding Decision 1/2026 del 28 maggio 2026Official source:EDPB - Guidelines 09/2020 on relevant and reasoned objection

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
EDPBfirst statement on smart glasses

Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell

They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.

Oct 13, 2026New 5 min
EDPB / EDPS
25the authorities looking at your privacy notice this year, not at your registers

The year the authorities read the privacy notice: CEF 2026 on transparency

On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.

Oct 09, 2026New 7 min
EDPB / EDPS
13 novlast day to send comments to the consultation

When a fine, and when not: the EDPB writes down the part that was missing

On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.

Sep 21, 2026New 6 min