The Argument the Regulator Reached For
The Belgian Data Protection Authority, acting as lead supervisory authority, tried to close a cookie complaint without ever examining the cookie banner. Its proposal was to dismiss the case as an abuse of rights under Articles 77 and 80(1) GDPR. The complaint concerned the consent banner of the Vlaamse Radio- en Televisieomroeporganisatie, the Flemish public broadcaster, and it came from noyb, the privacy organisation that files complaints at scale through the representative-mandate route in Article 80(1) GDPR.
The Austrian Data Protection Authority objected. That objection is what moved the file out of Belgium and into the consistency mechanism, and it is why the European Data Protection Board ended up ruling under Article 65(1)(a) GDPR instead of the Belgian authority simply closing the matter.
The result is EDPB Binding Decision 1/2026. It was adopted on 28 May 2026 and published on 14 July 2026. The adoption is the older event. The publication on 14 July is what put the reasoning in front of everyone who runs a banner in the European Union.
What the Board Decided on 28 May
The European Data Protection Board found no abuse of rights, and it found that neither element such a finding requires had been made out. Applying the standards developed by the Court of Justice of the European Union, it held that neither the objective element nor the subjective element was met.
It then instructed the lead supervisory authority to assess the complaint on the merits and to submit a new draft decision under Article 60(3) GDPR. No deadline for that new draft is stated.
Read carefully, this is a procedural ruling and nothing more. It does not create a rule about banner design. It does not find that the broadcaster did anything wrong. Nothing has been decided on the merits, no penalty has been set, and the question of whether the banner was lawful sits exactly where it sat in 2021, waiting to be answered.
Volume Does Not Make a Mandate Suspect
A procedural escape hatch just closed, and it was the one most operators were quietly relying on. The argument had an obvious appeal. This complaint is one of thousands filed by an activist organisation, so treat the filing itself as the defect and dismiss it. A national regulator, acting as lead authority, actually ran that argument. The Board rejected it in a binding decision.
The principle as reported is that a valid mandate under Article 80(1) GDPR does not become suspect merely because the representative organisation operates at scale. That framing comes from reporting on the decision rather than from the decision text, and it is worth holding loosely for that reason. The outcome itself is not in doubt.
The consequence for an owner is direct. Your exposure on a consent banner is decided by the banner's design, not by who complained about it or how many complaints they filed. Any defence built on the identity or the throughput of the complainant is now a defence that a lead authority has tried and lost with.
Five Years in a Queue, and Still Live
The complaint was lodged on 10 August 2021. It is only now being sent back for a decision on its merits, almost five years later. It sat in a queue, and the sitting changed nothing about its standing.
The lesson we draw is that a dormant complaint keeps its full force. A banner you fixed in 2023 does not retire the complaint someone filed against the version you ran in 2021. Assume the version you shipped years ago is still assessable, because in this case it is.
What This Changes on Your Site
Work from the assumption that the banner you ran years ago is still assessable, rather than from the age of your archive. If you cannot produce the consent interface as it appeared in 2021 or 2022, you cannot show what a supervisory authority would actually be assessing, and you will be arguing about a screen you no longer have.
So keep versioned records of the banner itself. The wording, the button hierarchy, the default states, the layer at which refusal was offered. These are the things a merits assessment looks at, and they are the things that quietly change every time a consent platform pushes an update.
And stop treating a filing count as a risk signal. The number of complaints an organisation files tells you nothing about whether the one against you will be heard. Binding Decision 1/2026 indicates that it will be.
Read next: The EU Is Rewriting the GDPR | A First Data Request Can Already Be Abusive
