The European Data Protection Board (EDPB) issued a binding decision on 28 May 2026, requiring the Belgian data protection authority to examine the substance of a complaint regarding cookie banners.

The decision follows a complaint filed by the Austrian non-governmental organization (NGO) Noyb with the Austrian authority, on behalf of a natural person, against the Belgian public broadcasting company Vlaamse Radio-en Televisieomroeporganisatie (VRT). The Belgian authority, acting as the lead supervisory authority, had initially proposed to dismiss the complaint citing an abuse of rights under Article 77 and Article 80, paragraph 1 of the GDPR. The Austrian authority, as the concerned supervisory authority, opposed this, leading to the referral to the EDPB under the dispute resolution mechanism of Article 65, paragraph 1, point a) of the GDPR.

The EDPB found the Austrian authority's objection relevant and well-founded. It concluded that, based on the information provided and in accordance with the Court of Justice of the European Union (CJEU) test for alleged abuse, the necessary objective and subjective components to demonstrate such abuse were not established. Consequently, the EDPB ordered the Belgian authority not to dismiss the complaint but to assess it on the merits and submit a new draft decision to the concerned supervisory authorities, in accordance with Article 60, paragraph 3 of the GDPR.