Belgian DPA imposes strict measures on Mediahuis for cookie consent violations
Privacy authority orders media company to revamp cookie banners, citing lack of clear opt-out and misleading designs
The Belgian Data Protection Authority (DPA) this week issued a decision against media company Mediahuis, ordering significant changes to the cookie consent mechanisms on four of its news websites. The decision comes after a complaint filed in July 2023 by a private individual, represented by privacy advocacy group noyb.
The DPA's Litigation Chamber found that Mediahuis violated EU data protection laws on several fronts regarding how it obtains consent for cookies and similar tracking technologies. Specifically, the authority cited issues with:
- Lack of a clear "reject all" option on the first layer of cookie banners
- Use of misleading button colors to encourage acceptance
- Making it more difficult to withdraw consent than to give it
- Improperly relying on legitimate interest for non-essential cookies
As a result, the DPA has ordered Mediahuis to implement the following changes within 45 days:
- Add a "reject all" option on every layer of the cookie banner where an "accept all" option is present
- Ensure the reject and accept buttons are displayed equally prominently, without misleading designs
- Make it as easy to withdraw consent as to give it
To enforce compliance, the authority imposed a potential fine of €25,000 per day per website if the changes are not made by the deadline, up to a maximum of €10 million.
The decision applies to four major Belgian news sites operated by Mediahuis: De Standaard, Gazet van Antwerpen, Het Belang van Limburg, and Het Nieuwsblad.
In its ruling, the DPA emphasized that obtaining valid consent requires giving users a free and unambiguous choice. The authority found that Mediahuis' previous cookie banners did not meet this standard by making it easier to accept cookies than reject them.
"A choice implies at least an equally valid option to perform a different action (no consent) than the one for which the choice is offered (consent)," the decision states.
The DPA also criticized Mediahuis' use of eye-catching colors for the "accept" button while making the alternative options less visible. This was found to violate the principle of fairness in data processing.
Additionally, the authority ruled that Mediahuis improperly relied on legitimate interest as a legal basis for certain cookies that require explicit consent under EU law. The company has since removed references to legitimate interest from its cookie banners.
While acknowledging some past legal uncertainty around cookie requirements, the DPA stated that recent court rulings and regulatory guidance have clarified the correct interpretation of EU data protection laws in this area.
The decision marks one of the strictest enforcement actions yet by the Belgian DPA regarding cookie consent practices. It aligns with an ongoing push by European regulators to crack down on deceptive cookie banner designs and ensure users have meaningful control over online tracking.
Mediahuis has the option to appeal the decision to the Brussels Court of Appeal within 30 days. However, the required changes must still be implemented by the deadline unless a court grants a stay of execution.
The case highlights the increasing regulatory scrutiny of cookie consent mechanisms and emphasizes the need for companies to provide clear, equally prominent options for users to both accept and reject non-essential cookies and tracking.
Key facts
- Decision issued: September 6, 2024
- Authority: Belgian Data Protection Authority
- Company: Mediahuis
- Websites affected: De Standaard, Gazet van Antwerpen, Het Belang van Limburg, Het Nieuwsblad
- Implementation deadline: 45 days
- Potential daily fine: €25,000 per website (up to €100,000 total)
- Maximum total fine: €10 million