Decision date: 22 April 2026

Cited provisions: Art. 12(3) GDPR, Art. 12(5) GDPR, Art. 15 GDPR

Scope: Cookie consent classification

The case centered on access and information requests, with no direct relation to cookies or consent mechanisms.

Decision date: 28 May 2026

Cited provisions: Art. 5(1)(a) GDPR, Art. 6(1)(a) GDPR, Art. 12(1) GDPR, Art. 12(2) GDPR, Art. 13(1)(c) GDPR, Art. 57(1)(f) GDPR, Art. 60(3) GDPR, Art. 60(4) GDPR, Art. 65(1)(a) GDPR, Art. 77 GDPR, Art. 80(1) GDPR

Scope: Cookie consent classification

On 10 August 2021, a data subject represented by noyb lodged a complaint with the Austrian DPA against Vlaamse Radio- en Televisieomroeporganisatie (VRT), the controller. The complaint concerned the controller’s cookie banner and alleged infringements of Articles 5(1)(a), 6(1)(a), 12(1), 12(2) and 13(1)(c) GDPR, as well as [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5(3) ePrivacy Directive]. It formed part of a wider project involving similar cookie banner complaints submitted by noyb across the EEA. The Austrian DPA transferred the complaint to the Belgian DPA, which acted as the lead supervisory authority. In its draft decision, the DPA proposed dismissing the complaint without examining its merits. It considered that the data subject and noyb had abused the rights provided under Articles 77 and 80(1) GDPR. The DPA relied on factors including the standardised and partly automated preparation of the complaints, noyb’s role in selecting the targeted controllers, the relationship between the data subject and noyb, and the broader strategic objectives pursued by the organisation. It considered that both the objective and subjective elements required to establish an abuse of rights were present. The Austrian DPA raised a relevant and reasoned objection under Article 60(4) GDPR. It argued that the circumstances did not demonstrate an abuse of rights and requested that the complaint be examined on its merits in accordance with Article 57(1)(f) GDPR. As the DPA did not follow the objection, it referred the dispute to the EDPB under Article 65(1)(a) GDPR. The EDPB first held that it was competent to decide the dispute. Its powers under Article 65(1)(a) GDPR are not limited to determining whether a controller infringed the GDPR. They also cover disputes concerning whether an action envisaged by a supervisory authority, including the dismissal of a complaint, complies with the GDPR. The EDPB found that the Austrian DPA’s objection met the requirements of Article 4(24) GDPR. The objection was directly connected to the draft decision, proposed a different outcome and sufficiently demonstrated the risks that the dismissal would create for data subjects’ rights and the consistent application of the GDPR. On the merits, the EDPB recalled that the prohibition of abuse of rights must be interpreted strictly, particularly where its application may restrict the fundamental right to data protection and the rights provided by Articles 77 and 80(1) GDPR. The supervisory authority alleging abuse bears the burden of establishing both its objective and subjective elements on the basis of sufficient evidence. Regarding the objective element, the EDPB acknowledged that noyb had organised a project involving predefined selection criteria, standardised complaints and automated tools. However, the data subject had validly mandated noyb under Article 80(1) GDPR and had lodged a complaint concerning an alleged infringement of their own data protection rights. Consequently, the objectives of Articles 77 and 80(1) GDPR had been fulfilled rather than circumvented. Regarding the subjective element, the EDPB found no evidence that the complaint had been submitted to obtain an undue advantage unrelated to the purposes of the GDPR. The objectives pursued by noyb could not be separated from those of the data subject merely because the organisation had played a leading role in preparing the complaint. Nor was there evidence that the data subject or noyb had sought compensation or another financial benefit. The EDPB therefore concluded that the data subject had not abused the right to lodge a complaint under Article 77 GDPR or the right to be represented under Article 80(1) GDPR. It instructed the DPA not to dismiss the complaint on that basis, to assess it on its merits and to submit a new draft decision to the supervisory authorities concerned under Article 60(3) GDPR.

Decision date: 16 January 2026

Cited provisions: Art. 5(1)(a) GDPR, Art. 12 GDPR, Art. 13 GDPR

Scope: Cookie consent classification

The company placed cookies on users' devices without displaying a cookie consent banner, violating the requirement for prior consent.

Decision date: 29 April 2025

Cited provisions: Art. 4(11) GDPR, Art. 5 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR

Scope: Cookie consent classification

The cookie banner provided generic information and non-functioning links, leading to invalid consent due to unclear cookie information.

Decision date: 20 August 2024

Cited provisions: Art. 5(2) GDPR, Art. 28(1) GDPR, Art. 44 GDPR, Art. 46 GDPR, Art. 83(2)(a) GDPR, Art. 83(2)(k) GDPR

Scope: Cookie consent classification

Takeaway B.V. transferred personal data, including cookie identifiers, to Google Analytics servers in the U.S.A without valid consent, involving third-party tracking without consent.

Decision date: 16 May 2024

Cited provisions: Art. 6(1)(a) GDPR, Art. 6(1)(f) GDPR, Art. 5(1)(a) GDPR, Art. 12(1) GDPR

Scope: Cookie consent classification

The case involved unauthorized use of personal data for political spamming, not related to cookies or consent.

Decision date: 21 February 2024

Cited provisions: Art. 6(1) GDPR

Scope: Cookie consent classification

The cookie banner did not include a 'reject all' option on the first layer, requiring users to confirm default selections instead.

Decision date: 19 September 2023

Cited provisions: Art. 3 GDPR, Art. 4(1) GDPR, Art. 4(11) GDPR, Art. 5(1)(a) GDPR, Art. 17(1)(d) GDPR, Art. 19 GDPR, Art. 77(1) GDPR

Scope: Cookie consent classification

The website's cookie banner lacked a reject button, set cookies before consent, and provided unclear information about cookie usage.

Decision date: 21 February 2024

Cited provisions: Art. 7(3) GDPR

Scope: Cookie consent classification

The website did not provide an option to withdraw consent, violating the requirement for an accessible mechanism to revoke cookie consent.

Decision date: 21 December 2023

Cited provisions: Art. 5(1)(a) GDPR, Art. 6(1)(c) GDPR, Art. 9(2)(a) GDPR, Art. 9(2)(e) GDPR, Art. 13(4) GDPR, Art. 14(5) GDPR

Scope: Cookie consent classification

The case involved unlawful processing of personal data related to political party representation, not related to cookies or consent.

Decision date: 19 September 2023

Cited provisions: Art. 7(3) GDPR, Art. 4(11) GDPR

Scope: Cookie consent classification

The website's cookie banner lacked a reject button on the first layer, used deceptive design, and did not provide an easy way to withdraw consent.

Decision date: 8 February 2023

Cited provisions: Art. 5(1)(a) GDPR, Art. 5(2) GDPR, Art. 6(1)(a) GDPR, Art. 4(11) GDPR, Art. 58(2)(d) GDPR

Scope: Cookie consent classification

GulogGratis used a cookie wall that forced users to consent to cookies or pay for access, compromising the voluntariness of consent.

Decision date: 8 February 2023

Cited provisions: Art. 5(1)(a) GDPR, Art. 5(2) GDPR, Art. 6(1)(a) GDPR, Art. 4(11) GDPR, Art. 58(2)(d) GDPR

Scope: Cookie consent classification

A cookie wall forced users to consent to cookies or subscribe for access, questioning the 'freely given' nature of consent.

Decision date: 9 June 2022

Cited provisions: Art. 5(2) GDPR, Art. 13(1)(f) GDPR, Art. 24 GDPR, Art. 44 GDPR, Art. 46 GDPR

Scope: Cookie consent classification

The news website used Google Analytics cookies, transferring data to the US without appropriate safeguards or user consent.

Decision date: 7 July 2022

Cited provisions: Art. 6(1)(a) GDPR, Art. 6(1)(f) GDPR

Scope: Cookie consent classification

TikTok planned to use cookies for personalized advertising without obtaining prior user consent, relying instead on legitimate interest.

Decision date: 21 January 2022

Cited provisions: Art. 5(1)(a) GDPR, Art. 6(1)(f) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR

Scope: Cookie consent classification

The website forced users to accept cookies to select advertising preferences, and the opt-out option for third parties did not work.

Decision date: 5 January 2022

Cited provisions: Art. 6(1)(f) GDPR, Art. 15 GDPR

Scope: Cookie consent classification

The European Parliament's internal coronavirus testing website had unclear cookie banners and data protection notices.

Decision date: 7 October 2021

Cited provisions: Art. 15(1) GDPR, Art. 58(2)(c) GDPR

Scope: Cookie consent classification

The company allowed third-party cookies without user consent and provided unclear information about cookie usage and data processing.

Decision date: 3 May 2021

Scope: Cookie consent classification

A data subject complained around cookies and similar technologies used in connection to audiovisual material on the website of the Court of Justice of the European Union (CJEU), as well as websites displaying the Court's branding that the Court linked to (two firms, Companywebcast and Connectedviews, to host a conference recording), claiming that they did not correctly inform the user or obtain required consent before data processing or storage of information on a terminal device. The complaint was decided under the data protection regime applying to EU institutions, rather than the GDPR (Regulation (EU) 2018/1725). The dispute concerned: - did the laying of cookies by the CJEU violate Article 37 of the Regulation, implementing the requirements of the e-Privacy Directive? - did the laying of cookies and the lack of transparent information on a third party website, with CJEU branding, linked to by the CJEU to provide it with services, breach the transparency (art 14) and consent (art 7) requirements of Regulation (EU) 2018/1725? - were the conditions for consent met by the CJEU? The EDPS held that there had been violations by the CJEU, on its own webpages of several provisions of Regulation (EU) 2018/1725. - Article 37 (accessing and storage of information on a terminal device), on the basis that the CJEU did not inform the user about the potential for YouTube cookies to be set if they accepted, nor did they provide a mechanism to refuse all cookies on the website. - Article 7 (conditions for consent), "as the CJEU did not provide its website users with a way to withdraw their consent regarding the use of cookies as easily as giving it - such as a ‘reject’ button displayed in the same place and in the same manner as the ‘accept’ button. Instead, in order to reject cookies, users had to click on the button ‘more information’ and go almost to the bottom of the page to withdraw their consent." It held that there were partial violations of - Article 14 (transparency), in relation to the CJEU's website's own YouTube cookies. In relation to the third party websites, Fashion ID applied, as the CJEU had no obligation to inform users of cookies laid by a website linked to by that website, regardless of whether it was a service the CJEU were using to deliver material or the branding on the site. The CJEU rectified all breaches following the complaint, in co-operation with the EDPS. As a result, the EDPS did not use any of its corrective powers. The EDPS also used the complaint to deploy its [https://joinup.ec.europa.eu/collection/free-and-open-source-software/solution/website-evidence-collector Website Evidence Collector (WEC)]. In relation to linked pages of third party services that the CJEU used to host branded conference videos, which laid Google and DoubleClick cookies without information or a possibility to reject, these were in breach of the law but did not fall within EDPS jurisdiction, and the CJEU had no obligation to provide information on cookies on pages it linked to ([https://gdprhub.eu/index.php%3Ftitle=CJEU_-_C%E2%80%9140/17_-_Fashion_ID Fashion ID] applied). This case clarified and confirmed that a withdraw button is needed to be placed as clearly as an accept button in order for consent to be valid to cookies and similar technologies. The EDPS took no formal action as the CJEU engaged rapidly with the organisation and rectified all breaches following the complaint.

Decision date: 9 April 2021

Scope: Cookie consent classification

The political party's website placed analytical cookies before obtaining consent and did not offer an option to reject cookies.

Decision date: 11 September 2020

Cited provisions: Art. 6(3) GDPR

Scope: Cookie consent classification

The case focused on the legal basis for sending SMS messages about a health app, not related to cookies or consent mechanisms.

Authority: Garante per la protezione dei dati personali (Italy)

Decision date: 31 January 2020

Cited provisions: Art. 5(1)(a) GDPR, Art. 5(1)(c) GDPR, Art. 6(1)(c) GDPR, Art. 6(1)(e) GDPR

Scope: Cookie consent classification

The case involved the unlawful dissemination of teachers' personal data on the school's website, unrelated to cookies or consent mechanisms.

Decision date: 20 December 2019

Cited provisions: Art. 6(1)(f) GDPR, Art. 21(2) GDPR

Scope: Cookie consent classification

The case is about unauthorized marketing emails, not related to cookies or consent mechanisms.

Decision date: 25 February 2021

Scope: Cookie consent classification

Valco Oy was ordered to correct its cookie practices, focusing on the evaluation of strictly necessary cookies and the validity of consent.

Decision date: 29 December 2021

Scope: Cookie consent classification

Innowise was ordered to correct its cookie practices, focusing on the evaluation of strictly necessary cookies and the validity of consent.

Decision date: 29 December 2021

Scope: Cookie consent classification

The investigation was closed as non-essential cookies were no longer used.

Decision date: 7 March 2022

Scope: Cookie consent classification

DigiFinland Oy was ordered to improve cookie consent practices by adding a reject button and providing clearer information.

Decision date: 10 March 2022

Scope: Cookie consent classification

Terveyden ja hyvinvoinnin laitos was required to correct cookie practices due to the absence of a reject button.

Decision date: 18 March 2022

Scope: Cookie consent classification

Suomenmaan kustannus Oy was ordered to address the lack of a reject button in its cookie consent mechanism.

Decision date: 20 April 2022

Scope: Cookie consent classification

Posti Oy was found to have issues with cookie consent validity and third-party tracking without consent.

Decision date: 9 May 2022

Scope: Cookie consent classification

Avain asumisoikeus Oy was ordered to correct cookie practices due to the absence of a reject button and lack of consent withdrawal options.

Decision date: 21 June 2022

Scope: Cookie consent classification

Kekkilä-BVB was directed to improve cookie information clarity and address third-party tracking without consent.

Decision date: 29 September 2022

Scope: Cookie consent classification

Suomalainen Kirjakauppa was ordered to enhance clarity in cookie information and consent validity.

Decision date: 16 December 2022

Scope: Cookie consent classification

Nordea Bank was instructed to improve clarity in cookie information and consent validity.

Decision date: 8 June 2023

Scope: Cookie consent classification

Sanoma Media Finland was ordered to address issues with consent withdrawal, unclear cookie information, and third-party tracking without consent.

Decision date: 21 November 2023

Scope: Cookie consent classification

Telia Finland was ordered to correct cookie practices related to consent withdrawal and providing clear information.

Decision date: 21 November 2023

Scope: Cookie consent classification

XXL Sports & Outdoor was ordered to improve consent validity, withdrawal options, and clarity of cookie information.

Decision date: 26 April 2024

Scope: Cookie consent classification

Otavamedia faced issues with consent withdrawal, unclear cookie information, and unauthorized third-party tracking technologies.

Decision date: 28 May 2024

Scope: Cookie consent classification

Lippupiste was ordered to address issues with unclear cookie information and lack of mechanisms for withdrawing consent.

Decision date: 7 June 2024

Scope: Cookie consent classification

A-lehdet was found to have unclear cookie information and used third-party tracking technologies without obtaining proper consent.

Decision date: 12 June 2024

Scope: Cookie consent classification

Foreca was ordered to correct unclear cookie information and improve mechanisms for withdrawing consent.

Decision date: 16 October 2025

Scope: Cookie consent classification

Silmäasema was ordered to improve the clarity of cookie information and ensure valid consent practices.

Decision date: 31 October 2023

Scope: Cookie consent classification

PTS closed its cookie supervision after Tele2 rectified its practices.

Decision date: 31 October 2023

Scope: Cookie consent classification

PTS closed its cookie supervision after Swedbank rectified its practices.

Decision date: 31 October 2023

Scope: Cookie consent classification

PTS closed its cookie supervision after Konsumentverket rectified its practices.

Decision date: 31 October 2023

Scope: Cookie consent classification

PTS closed its cookie supervision after Folkhälsomyndigheten rectified its practices.

Decision date: 7 August 2025

Cited provisions: Art. 12(1) GDPR, Art. 12(2) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR

Scope: Cookie consent classification

A data subject, represented by noyb, brought a complaint against Google LLC (the controller) in January 2019. According to the data subject, the controller did not provide them with complete information following an access request for the YouTube service; instead, the controller provided limited information through a download portal, which excluded information the controller stated it would process in accordance with its privacy policy. For example, the data provided did contain information on the data processed through cookies or Facebook pixels. The DPA initiated the One-Stop Shop procedure and forwarded the case to the Irish DPA, who also believed it should be considered the lead DPA for the proceedings. However, the Irish DPA ultimately declared it was not responsible in 2022, and referred the case back to the DPA. The controller argued that the data subject had incorrectly initiated proceedings against them, as it was not the controller within the meaning of the GDPR. In addition, it argued that the data subject had received complete information and that its DPO was not responsible. The DPA first emphasised the importance of the right to access (Article 15 GDPR), as it enables the data subject to verify whether a controller is processing personal data lawfully. In addition, Article 12(2) GDPR places an obligation on controllers to facilitate data subjects in exercising their rights. The DPA then dismissed the controller’s argument to reject the complaint, as Google LLC was the controller at the time the case was filed with the DPA. Furthermore, the DPA stated that it would have not dismissed the case even if the data subject had not chosen an entirely accurate name for the controller; it was clear that the data subject wanted to prosecute the entity responsible for the YouTube service. The DPO was considered responsible for handling the complaint, as the Irish branch was not considered the controller for YouTube. The DPA found a violation of Article 12(1) GDPR. The download portal provided information in formats design for machine processing, meaning it was not accessible for the average data subject. In addition, the controller stated that someone of the information may have been available in other secure online tools; this meant the data subject could not access a complete copy of their data through the online portal. The DPA also found violation of Article 15 GDPR, as the controller had not given the data subject sufficient information. According to the DPA, the controller’s privacy policy can fulfil the information obligations of Article 13 and 14 GDPR, but not Article 15 GDPR. This is because it is general information and may not apply to the data subject. The controller must also provide specific information relevant for the data subject, meaning it is not enough to give general statements. This applied to the processing purposes, categories of data, storage periods, tracking, and recipients of data. For the recipients of data, the DPA noted that as a leading IT company the controller could specify the specific recipients of the personal data, and the safeguards in place for third country transfers. The DPA ordered the controller to provide the data subject with a complete copy of their data. The DPA specified that referring to its privacy policy or the different online tools the data subject could use to compile the information themselves was not enough to comply with Article 12 GDPR.

Decision date: 27 August 2026

Cited provisions: Art. 4(11) GDPR, Art. 7(3) GDPR, Art. 5(3) ePrivacy Directive

Scope: Cookie consent classification

The media company used a two-layer cookie consent banner where rejecting cookies required more steps than accepting them, violating GDPR and ePrivacy Directive requirements.

Authority: Garante per la protezione dei dati personali (Italy)

Decision date: 14 May 2026

Cited provisions: Art. 5(1)(a) GDPR, Art. 5(2) GDPR, Art. 14 GDPR, Art. 5(3) ePrivacy Directive

Scope: Cookie consent classification

An individual company (the controller) engaged in a B2B marketing campaign. To this end, it bought a data set from a third-party: a sales platform called Apollo.io. The set consisted of about 2,500 professional contacts, including email addresses, phone numbers, and personal details of the contacts as well as their role within organizations. It is not known how Apollo acquired the information. The controller then used the data for sending unsolicited marketing communications. The controller relied on its legitimate interest as its legal basis, pursuant to Article 6(1)(f) GDPR. Every email contained a short footer that explained the legal basis of the processing, identified Apollo.io as the source for the email address, and included an opt-out link. An individual (the data subject) filed a complaint after receiving one of said emails. The data subject had not consented to marketing communications from the controller, and yet still received them. Overall, the DPA found violations of Articles 5(1)(a) and 14 GDPR as well as Art. 130 c.1. d. lgs. 196/2003 (i.e.: the Italian implementation of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02002L0058-20091219 Article 13 of the ePrivacy Directive]). The DPA issued a €1,500 fine. In quantifying the fine, the DPA took into account that the controller had taken steps to fix its violations before the decision. Additionally, the DPA ordered the controller to bring its processing of personal data into compliance – which included, among others, erasing the data and providing the addressees of its marketing campaign with all the information required by Article 14. = First, the DPA clarified that the case fell within the scope of both the GDPR and Article 13 of the ePrivacy Directive (as well as its implementation in Italian lawArt. 130 d. lgs. 196/2003.). The DPA pointed out that the data set, which the controller bought and processed, contained at least some personal data. On these grounds, the DPA held that the case fell within the scope of the GDPR even though the controller’s campaign was B2B in nature. With regards to the ePrivacy Directive, the DPA observed that Article 13 covers marketing carried out towards subscribers or usersThe Italian implementation closely follows the wording of the Directive ("contraente o utente"). of an electronic communications network, and clarified that the notions of “subscriber” or “users” may also cover legal persons. On these grounds, the DPA held that the Article applied to the case at hand regardless of the personal or non-personal nature of the data processed. = Article 13 of the ePrivacy Directive requires consent for sending unsolicited marketing emails. In the DPA’s view, this made it unlawful for the controller to rely on legitimate interest as its legal basis. On these grounds, the DPA held that the controller unlawfully processed personal data for marketing purposes. = The DPA acknowledged that the controller’s marketing emails contained a privacy notice but found it to be severely lacking. On these grounds, the DPA held that the controller violated Article 14 GDPR as well as the transparency principle. = In its defence, the controller pointed out that Apollo had put forward claims that its processing complied with applicable laws and that the data set it sold, could lawfully be used for marketing. The DPA, however, applied the principle of accountability (Article 5(2) GDPR) and concluded that the documental or contractual guarantees provided a third-party, did not exempt the controller from assessing the lawfulness of its processing and did not shield the controller from liability.

Decision date: 16 July 2026

Cited provisions: Art. 13 GDPR, Art. 37(1)(b) GDPR, Art. 58(2)(d) GDPR, Art. 83 GDPR

Scope: Cookie consent classification

In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website. The data subject claimed that the privacy information applicable to users in the EEA was not easily accessible, as the main privacy link led to a global policy. The data subject also alleged that users could not create an account without apparently accepting promotional communications, that the registration form did not correctly link to the privacy policy and that the controller had not appointed a data protection officer. The complaint further identified deficiencies in the privacy information, including insufficient details about the identity of the controller, recipients, international transfers and retention periods. During the investigation, the controller acknowledged that certain links and checkbox descriptions had been incorrectly configured and undertook to correct them. It maintained, however, that its privacy information was provided through several interconnected documents and that it was not required to appoint a DPO. According to the controller, it did not engage in profiling, its marketing communications were based on opt-in consent and the processing of personal data was ancillary to its restaurant business. The DPA found that the information provided on the website was excessively generic and did not comply with Article 13 GDPR. It imposed a €5,000 fine and ordered the controller to bring its website into compliance. The DPA also concluded that the controller’s processing activities required the appointment of a DPO under Article 37(1)(b) GDPR. It imposed a further €20,000 fine and ordered the controller to appoint a DPO. The controller appealed both the sanctioning decision and a subsequent resolution requiring it to demonstrate that it had implemented corrective measures. The Court dismissed the appeal and upheld the total fine of €25,000. Regarding Article 13 GDPR, the Court found that the controller’s privacy information was excessively generic and did not clearly explain the purposes, legal bases and relevant circumstances of the processing. It also held that the DPA was not limited to investigating only the exact issues identified in the initial complaint. The €5,000 fine was proportionate despite the controller’s subsequent corrective action. Regarding Article 37(1)(b) GDPR, the Court held that the controller was required to appoint a DPO. Although its primary business was the provision of restaurant services, the processing of customer data was inseparable from its online ordering, marketing, loyalty and customer-management activities. The processing also involved regular and systematic monitoring, as the controller continuously collected data such as customer preferences, browsing history, IP addresses, cookies and geolocation for commercial and operational purposes. Considering the number of data subjects, the volume and variety of data, the duration of the processing and its nationwide scope, the Court concluded that the processing was carried out on a large scale.