Belgium: Issued Data Protection Authority ruling on RTL Belgium’s alleged cookie banner violations of GDPR and Belgian law in case no. 131/2024

On 11 October 2024, The Data Protection Authority issued a decision in case no. 131/2024 regarding a complaint against RTL Belgium’s cookie banner. This complaint was lodged by a representative from Noyb (European Center for Digital Rights), alleging that RTL's cookie banner contravened both the General Data Protection Regulation (GDPR) and Belgian law. The complaint specifically highlighted that RTL's banner did not offer equal choices for users to "Accept All" and "Refuse All" cookies at the same informational level. Moreover, the banner employed different button colours—such as an attention-grabbing orange for "Accept All" and a more subdued blue for additional information—leading to accusations of misleading practices. Additionally, it was noted that withdrawing consent was more complicated than granting it, which breached GDPR principles. Following the filing of the complaint in July 2023 and failed mediation attempts by December 2023, RTL Belgium defended its case in early 2024, questioning the admissibility of the complaint and the role of Noyb. However, the Data Protection Authority found that RTL Belgium's cookie practices violated Article 6.1.a of the GDPR, which mandates free and informed consent, along with relevant Belgian laws. The Data Protection Authority concluded that RTL’s banner design unduly influenced users towards accepting cookies without providing a readily accessible option to refuse them. The authority dismissed RTL's argument regarding artistic expression, affirming that data protection laws override aesthetic considerations in these contexts. As a result, the Data Protection Authority ruled against RTL Belgium, imposing a fine of EUR 40'000 per day for its non-compliant cookie banner and providing recommendations for compliance.