Belgian data protection case moves forward against DPG Media

According to a decision published on January 24, 2025 (Decision 16/2025), the Belgian Data Protection Authority (DPA) has determined that complaints filed by noyb against DPG Media's cookie practices on four news websites can proceed to a full investigation. The decision addresses preliminary procedural objections regarding noyb's standing to represent complainants.

The case stems from complaints filed on July 19, 2023, concerning the cookie consent mechanisms on hln.be, demorgen.be, vtm.be, and 7sur7.be. The complaints allege violations of Belgian data protection law and the GDPR related to cookie consent practices. Specifically, they challenge the absence of a clear "reject" option at the first information level of the cookie banner.

The Belgian DPA's Litigation Chamber examined whether noyb, as a privacy advocacy organization, could validly represent individual complainants. This question gained particular significance after recent decisions in other cases where the DPA had questioned the validity of noyb's representation.

DPG Media had raised procedural objections, arguing that noyb lacked proper standing to represent the complainants. The media company contended that the complaints were part of a broader campaign rather than genuine individual grievances. However, the Litigation Chamber found significant differences between this case and previous decisions where complaints through noyb had been dismissed.

The decision carefully distinguishes the current case from previous matters, particularly the "VOO decision" (Decision 22/2024). While in the VOO case there was evidence of pre-existing instructions from noyb to potential complainants, the current complaints showed no such prior coordination. The Litigation Chamber emphasized that complainants' employment or internship status with noyb does not automatically invalidate their right to file complaints.

The case raises fundamental questions about cookie consent mechanisms on major Belgian news websites. The complainants argue that the current implementation violates several legal requirements, including the principle that withdrawing consent should be as easy as giving it. They specifically challenge the multi-step process required to withdraw previously given consent.

The Litigation Chamber will now examine three main allegations: violations of Belgian law regarding electronic communications and GDPR consent requirements, potential misleading design elements in the cookie banner's color scheme, and difficulties in withdrawing cookie consent.

This decision marks a significant procedural victory for noyb, confirming its ability to represent individuals in Belgian data protection cases when proper mandates exist. It also signals the Belgian DPA's nuanced approach to examining representative actions in data protection matters.

The Belgian DPA's analysis focused heavily on distinguishing between coordinated campaigns and legitimate individual complaints supported by advocacy organizations. This distinction may influence how other European data protection authorities approach similar cases.

The decision comes at a time of increasing scrutiny of cookie consent mechanisms across Europe, particularly on news websites that reach large audiences. DPG Media's websites serve significant Dutch-speaking and French-speaking populations in Belgium, making the outcome of this case particularly relevant for media organizations operating across linguistic communities.

According to the decision document, parties now have the opportunity to submit detailed arguments on the merits of the case. The Belgian DPA maintains jurisdiction to impose corrective measures or administrative fines if violations are found.

The case highlights ongoing tensions between media organizations' digital advertising practices and evolving interpretations of data protection requirements. It also demonstrates the complex procedural questions facing data protection authorities as they navigate complaints brought through advocacy organizations.