EDPB opinions: binding or merely indicative?

Introduction

On April 29, 2025, the General Court of the European Union ruled in the case T-319/24, in which technology giant Meta Platforms Inc. had filed an appeal against the Opinion 08/2024 on valid consent in the context of "consent or pay" models used by large online platforms of the European Data Protection Board (EDPB).. This ruling clarifies the legal status of EDPB opinions.

As a law firm in privacy law and data protection we analyze for you the essence of this ruling and the practical implications for companies or government agencies processing personal data.

Case Background

The case revolves around the "consent or pay" business model implemented by Meta. Under this model, users are presented with a two-pronged choice: either consent to behaviorally targeted ads (and thus the processing of their personal data) and free access to a service, or pay to access the service without such ads.

The EDPB published Opinion 8/2024 stating that such a model rarely meets the GDPR-standard of "freely given consent." Meta challenged this opinion in the General Court because it believed the avies directly targeted its business model and would cause significant financial harm.

The judgment of the General Court

In its order of April 29, 2025, the General Court of the EU rejected Meta's application for annulment of this Opinion. The General Court's core reasoning:

1. EDPB opinions issued under Section 64(2) of the AVG have no binding legal effect
2. Such opinions merely provide guidance and evaluation criteria for national supervisory authorities
3. These authorities remain free to make their own decisions
4. Without a concrete decision by a supervisory authority, there is no direct legal change for Meta

Notable is the Court's explicit formulation in paragraph 28 that this is "opinions to which no special authority is granted". A remarkable qualification by the Court for an instrument that has great practical impact.

The General Court ruled that Meta's appeal was inadmissible under Article 263 TFEU, which only allows for challenging acts having legal effect.

The claim for damages

In addition to annulment of the Opinion, Meta also sought damages under Article 268 TFEU. Meta claimed that the Opinion would lead to a decrease in advertising revenues and user subscriptions. This claim was also dismissed because:

1. The alleged injury was considered hypothetical
2. The causal link was not proven
3. No supervisory authority had ordered Meta to change its model

Legal analysis and implications

The paradox of "Soft Law" in the EU

This ruling underscores a fundamental tension in EU law in which regulators attempt to use their own instructions to steer legislation in a particular direction. Although the EDPB may hide behind the formal "non-binding" nature of its authority, in practice it exercises great power. Its formally non-binding guidelines ("soft law") often exert significant influence in practice

EDPB opinions get their de facto authority from two sources:

1. Their formal entrenchment in the AVG
2. The reality that companies and government agencies often follow them as a precautionary measure from the reflex that it is safer to follow the EDPB line than to go against it

This creates a systemic problem: instruments that officially have no binding legal effect, but in reality guide market decisions and supervisory practices, evade direct judicial review.

From EDPB to GBA and VTC: same issues?

This reasoning can equally be extended to the recommendations of the Belgian Data Protection Authority (GBA). The GBA regularly publishes recommendations and opinions which are formally non-binding, but in practice are equally considered normative by Belgian companies and government agencies. The same can be said about guidelines and recommendations of the Flemish Supervisory Commission (VTC).

These recommendations and opinions of the GBA and VTC, like EDPB opinions, exist in a legal twilight zone: they are not legislation or formal decisions, but they do have a guiding effect in the marketplace. Companies and government agencies follow them out of caution to avoid sanctions or negative publicity.

Following the same logic as that of the General Court in the Meta case, recommendations and opinions of the GBA or VTC cannot be directly challengeable before the Belgian administrative courts either. A company or government agency would then have to wait for a concrete enforcement action based on such a recommendation or advice before judicial review becomes possible. This creates the same legal uncertainty at the national level.

Broader implications for EU regulation

The ruling has potential implications beyond data protection law. This reasoning of the General Court may also apply to guidelines under other EU regulations, such as the recently adopted AI Act. The question arises whether and how soft law instruments, which are becoming increasingly important in complex technological regulation, can be subject to judicial review.

Future legal developments

There are strong indications that this case has not yet been concluded:

1. An appeal to the EU Court of Justice seems likely
2. A recent conclusion of the Advocate General in a case between Whatsapp and the EDPB, suggests that binding decisions of the EDPB that must be followed by a national supervisory authority are indeed subject to challenge
3. Consideration should be given to a way to make opinions of the EDPB and national supervisory authorities directly contestable in the future - a necessary and possible step toward greater control and balance

Practical implications for "Consent or Pay" models

For companies operating or considering "consent or pay" models, this ruling creates an uncertain legal situation:

1. The EDPB opinion, although legally "without particular authority," is likely to influence the decision-making of national regulators including the GBA
2. Supervisors will simply apply these guidelines in practice, despite their formally non-binding status
3. A final legal judgment on AVG compatibility will come only after concrete enforcement actions are taken

Consulting for businesses and government agencies

Given this complex legal situation, we recommend:

1. EDPB opinions as well as those of the GBA or the VTC should not be underestimated despite their formally non-binding nature
2. Understand the tensions between formal non-binding and practical influence
3. Proactively seek legal advice on data models that may be at odds with these guidelines
4. Develop compliance strategies that take into account the likely interpretation of the AVG by regulators
5. Closely monitor developments regarding possible appeals and enforcement actions

Conclusion: greater demand for the digital economy

In any case, this case touches on a fundamental question for the entire digital economy: how can regulation be designed in a more transparent and testable way? The current situation, where non-binding guidelines have great influence but evade judicial review, is unsatisfactory for all concerned.

This development concerns not only Meta, but the entire digital economy. We must ask ourselves how regulation can be made more transparent and verifiable. This applies both at the European level through the EDPB and at the national level through authorities such as the GBA and the VTC.

The General Court's ruling may not be the end of this story, but rather a chapter in a longer legal development around how EU regulation and national implementation of the digital economy should be shaped.