Joris DeeneYes. Article 105 of the Act of December 3, 2017, establishing the Data Protection Authority, provides that the statute of limitations for such offenses expires five years after they are committed, and that only an investigative or prosecutorial action can interrupt that period. A complaint that remains pending with the Dispute Resolution Chamber therefore expires after five years, even if the cookie banner is still not in compliance at that time. In its decision of October 19, 2026, the Litigation Chamber dismissed, for that reason, a complaint filed in May 2020 against an online store that placed cookies as soon as the visitor continued browsing. It did note that the banner that appeared afterward—which featured only an “accept all” button and no “reject all” button—was also noncompliant, but took no further action on that point because the website had since been modified.
In short:
- On October 19, 2026, the Litigation Chamber of the Data Protection Authority dismissed a cookie complaint filed on May 11, 2020, because the facts prior to September 7, 2020, were time-barred and the last act of prosecution dated from September 2021.
- According to the Litigation Chamber, a cookie banner that, at the first level, offers only the option to “accept all” and not to “reject all” does not constitute free consent within the meaning of Articles 4(11), 6(1)(a), and 7 of the General Data Protection Regulation (GDPR) and Article 5(3) of the e-Privacy Directive.
- Anyone who modifies their banner before the decision is issued—including a visible opt-out button and an equally simple way to revoke consent—can expect the case to be dismissed without penalty, but the established violation will remain in the decision.
The facts
On May 11, 2020, an individual filed a complaint with the Data Protection Authority against a company that operates an online store. He had already brought the company’s cookie policy to its attention on February 11, 2020, and again on May 11, 2020, without receiving a substantive response. His complaint was twofold: the website did not offer visitors the option to accept or reject cookies—let alone by category—and the cookie policy stated that cookies were automatically placed as soon as the visitor navigated beyond the landing page.
The company did not dispute the facts. Its 2020 banner stated that the website used functional, analytical, and tracking cookies—including third-party cookies for personalized ads—and that anyone who continued to use the website agreed to this. According to the company, this constituted explicit consent: upon the first visit and when clicking the “more information” link, no marketing or tracking cookies were yet placed, and the visitor could leave the site or configure their browser to block cookies.
On September 7, 2020, four months after the complaint was filed, the company changed its procedures. Since then, marketing and tracking cookies have only been placed after the visitor has given explicit consent, and they are not placed as long as the visitor has not made a choice. The new banner featured an “Accept All” button on the first level and a “More Information” link that led to the second level, where the visitor could set their preferences.
The proceedings moved slowly. The First-Line Division declared the complaint admissible on May 12, 2020; the Litigation Chamber ruled on September 29, 2021, that the case was ready for consideration on the merits and set the deadlines for filing briefs. The company’s final brief was received on December 22, 2021. After that, nothing happened for more than three years. It was not until February 5, 2025, that the Litigation Chamber asked the complainant if he wished to maintain his complaint. He did: according to him, his cookie preferences were not saved correctly when he tried to change them.
The ruling
The Litigation Chamber issued its ruling on October 19, 2026, more than six years after the complaint was filed (GBA, October 19, 2026, Decision on the Merits No. 285/2026). It addressed two issues separately: the facts underlying the complaint and the banner that the company subsequently introduced.
The statute of limitations on cookie practices prior to September 7, 2020
The Litigation Chamber determined at the outset that the disputed facts predated September 7, 2020, and thus had ended more than six years before the decision. It applied the act of December 3, 2017, Establishing the Data Protection Authority in the version in effect prior to June 1, 2024, because the case was initiated before that date. Article 105 of that law provides that the statute of limitations for such offenses expires five years after they are committed and that the statute of limitations is suspended only by acts of investigation or prosecution.
According to the Litigation Chamber, the last act of prosecution took place in September 2021, when it declared the case file complete and notified the parties of the deadlines for submitting their closing arguments. The letter dated February 5, 2025, to the complainant, asking whether he maintained his complaint, does not, in her view, constitute an act of investigation or prosecution and therefore does not interrupt the statute of limitations. Consequently, the statute of limitations had expired, and the Litigation Chamber dismissed the grievances pursuant to Article 100, § 1, 1° of the Act, citing ground for dismissal A.2 of its dismissal policy.
The cookie banner without an "Opt Out" button after September 7, 2020
The Litigation Chamber did not stop there. Based on the company’s statement of November 10, 2021, it concluded that, after September 7, 2020, the banner on the first information level contained only an “accept all” button, and no “reject all” button. Visitors could only set their preferences via the “more information” link on the second level.
The Litigation Chamber noted that the placement of non-strictly necessary cookies requires free, specific, informed, and unambiguous consent, pursuant to Articles 4(11), 6(1)(a), and 7 of the General Data Protection Regulation (GDPR). According to her, a banner that, at the first level, allows everything to be accepted but does not allow everything to be rejected does not meet that requirement, because the visitor’s choice is then not free. She based this on the Report from the Cookie Banner Task Force of the European Data Protection Board dated January 17, 2023. In her view, this same conduct also violates Article 5, paragraph 3, of the e-Privacy Directive, because the concept of consent in that directive has the same meaning as in the GDPR, as the Guidelines 05/2020 on Consent set forth in the European Data Protection Board’s opinion of May 4, 2020.
Nevertheless, no penalty was imposed. The Litigation Chamber reviewed the website on October 6, 2026, and determined that the banner on the first level now included both a clearly visible “accept” button and a “decline” button, and that the cookie notice provided a visible option to adjust preferences, so that consent could be withdrawn just as easily as it was given, as required by Article 7(3) of the GDPR. It saw no reason to doubt that the visitor’s preferences are now being stored correctly, thereby also resolving the complainant’s remaining grievance from February 2025. It no longer deemed sanctions or corrective measures necessary or appropriate. She also dismissed that historical violation pursuant to Article 100, § 1, 1° of the Act, this time citing dismissal ground B.6 of her dismissal policy. The decision will be published without the names of the parties.
Legal analysis and interpretation
A three-year delay on the part of the DPA itself causes the complaint to become time-barred
Between the last ruling of December 22, 2021, and the letter of February 5, 2025, the Litigation Chamber took no action on this case. This inactivity is not attributable to the complainant or the company, and yet it is the complainant who loses the case. Article 105 of the Act of December 3, 2017, makes no distinction in this regard: the statute of limitations begins to run from the date of the events, and only an investigative or prosecutorial act can interrupt it. The Litigation Chamber considers its own decision of September 29, 2021—in which it declared the case closed—to be such an act, but not its letter from February 2025.
The counterargument is obvious: the letter dated February 5, 2025, was indeed a procedural act, as determined by the body handling the case. A broad interpretation of “act of prosecution” could include that letter, meaning a new five-year period would have begun and the October 2026 decision would have been issued well within the time limit. That interpretation is difficult to sustain. The letter was addressed to the complainant and not to the company, merely asked whether the complaint still stood, and did not bring the case any closer to a decision. The statute of limitations in Article 105 is borrowed from criminal law, where an “act of prosecution” is an action that brings the case before the trial court or anticipates such a proceeding. A reminder to the complainant does not fall under this category. The Litigation Chamber therefore opted for the strict interpretation, and the current text of Article 105 confirms this: since the reform of June 1, 2024, it has explicitly stated that an act that interrupts the statute of limitations triggers a new period of the same duration, which tightens rather than relaxes the rule.
The lesson for anyone filing a complaint is that the clock doesn’t stop when the complaint is filed. In this case, the facts occurred in the spring of 2020, the last interruption took place in September 2021, and the deadline therefore falls in September 2026. Had the Litigation Chamber rendered its decision a few weeks earlier, the outcome would have been different. A complainant has no control over the Litigation Chamber’s slow pace, but they can request in writing that it conduct an investigation when the case stalls, and they can simultaneously bring a case before a civil court, as that avenue remains open alongside the complaint.
The "Reject" button: the DPA finds the violation but, once again, does not impose a penalty
After September 7, 2020, the company had a banner with “accept all” on the first level and a link to the settings on the second. This is the most common form of a non-compliant cookie banner, and the Litigation Chamber explicitly states that it constitutes a violation of the GDPR and the e-Privacy Directive. An “opt-out” button is a button that allows the visitor to reject all non-essential cookies on the same screen and with the same effort as it takes to accept them. The report by the Cookie Banner Task Force dated January 17, 2023, states in points 6 through 8 that the absence of such a button constitutes a practice that does not result in free consent.
It is noteworthy that the Litigation Chamber has once again found the infringement without imposing a penalty. It had already done so in its decision of February 21, 2023 (DPA, February 21, 2023, Decision on the Merits No. 15/2023), in which she described the defendant’s revised banner as a step in the right direction, but treated the missing “decline” button merely as a recommendation because the Task Force’s report had been published only after the debates had concluded. In 2025, the decision against RTL Belgium followed, which we discussed earlier in our blog post about the withdrawn cookie complaint: there, too, the case was dismissed after the charges were amended (DPA, September 1, 2025, Decision on the Merits No. 138/2025). The decision of October 19, 2026, is the third in that series.
That pattern warrants a note. Anyone who interprets the decisions as a sign that the absence of a “decline” button has no consequences is misreading them. In all three cases, the banner had been modified before the decision was issued, and in the two most recent cases, the Litigation Chamber verified this itself on the website. Grounds for dismissal B.6 of the dismissal policy, which the Litigation Chamber applies here, pertains precisely to a violation that has since been rectified. The reverse situation—a website that still lacks a “decline” button on the day of the decision—is not addressed in those decisions, and the reasoning that the Litigation Chamber repeatedly cites leaves little room for that scenario. Furthermore, the fact that the violation remains in the reasoning—with specific names and article numbers—is not without significance: a subsequent complaint regarding the same website does not start from scratch.
Surfing through pages has not been permitted since 2019
Regarding the online store’s original practice of setting cookies as soon as a visitor clicks beyond the landing page, the Litigation Chamber did not rule on the matter due to the statute of limitations. The company’s defense—that continued use of the website constituted explicit consent because no cookies were placed during the first visit and the visitor could have left the site—has therefore not been assessed. It is worth noting that this defense has already been rejected in other cases.
In its Planet49 ruling (Court of Justice of the European Union, October 1, 2019, C-673/17), the Court of Justice held that that a pre-checked box does not constitute valid consent for cookies, because the user must take an active action. Guideline 05/2020 from the European Data Protection Board extends this principle to scrolling or navigating a website: this in no way satisfies the requirement for a clear, active action. The Litigation Chamber itself rejected the “continue browsing means consent” banner in the case against Telenet (DPA, February 12, 2021, Decision on the Merits No. 19/2021) and in the case against the Rossel media group (DPA, June 16, 2022, Decision on the Merits No. 103/2022), in each case because two consents—one for the use of the site and one for cookies—were inferred from a single action by the visitor, meaning that the consent was not specific. In Belgium, the cookie regulation has also been codified in law since January 10, 2022: Article 10/2 of the Act of July 30, 2018, on the Protection of Individuals with Regard to the Processing of Personal Data permits the placement of information on a user's terminal equipment only after clear information has been provided and consent has been obtained, with the sole exception of strictly necessary technical storage.
Even the announced European simplification does nothing to change that. On October 21, 2026, the Council of the European Union finalized its negotiating position on the proposed Digital Omnibus Regulation and retained the cookie rules from the e-Privacy Directive, with only additional purposes for which consent is not required, such as audience measurement and device security, as indicated in the Council press release. We discussed the original intent of that proposal in our blog post about the end of the cookie banner. The European Parliament has yet to adopt a position; until the new text is adopted and implemented, the opt-out button remains mandatory.
Specifically, what does this mean?
For anyone who runs a website or online store. The standard is clear and has now been reiterated by the Litigation Chamber for the third time: The first screen of the cookie banner must include a button to accept all non-essential cookies and an equally visible button to reject them, without having to go through “settings” or “more information.” A “continue” or “OK” button that only accepts cookies is not sufficient, nor is a banner that disappears when the visitor scrolls further. In addition, the visitor must be able to revoke their choice later just as easily as they made it—for example, via a permanent link in the cookie policy or in the footer—and that choice must actually be saved. So don’t just check your website for the text of the policy, but also for what the banner actually does technically; the requirements set by the data protection law for consent, can be found on our overview page.
If a complaint is filed after all, it is advisable to amend the banner immediately and to inform the Litigation Chamber of this in your conclusions. In this case, in the RTL case, and in the 2023 case, this was sufficient to have the case dismissed without a fine. However, do not rely on this blindly: the Litigation Chamber will still establish the violation, and in the event of a persistent or repeated violation, it has the full range of measures available under Article 100 of the Act of December 3, 2017, ranging from a reprimand to an administrative fine. If you are unsure whether your banner and your cookie statement will pass scrutiny, that technical and legal review is the first thing we will examine for you; anyone who receives a complaint or a question from the Litigation Chamber is best advised to immediately seek assistance from an attorney specializing in GDPR.
Who can file a complaint with the DPA? Filing a complaint is free and easy, but the complainant has little control over the pace of the process afterward. In this case, more than six years passed between the complaint and the decision, and that delay cost the complainant the case. Anyone who considers it important that the violation be formally established should keep their own evidence of the disputed practice (screenshots with dates, the text of the banner and the cookie statement, the results of a cookie scan); remind the Litigation Chamber in writing about the case when it stalls, and consider filing a claim in civil court, which can proceed alongside the complaint.
Frequently asked questions (FAQ)
How long can the DPA process a complaint about cookies before it expires?
Five years after the events, in accordance with Article 105 of the Act of December 3, 2017, establishing the Data Protection Authority. Only an investigative or prosecutorial action interrupts that period and triggers a new five-year period. The filing of the complaint, the parties’ submissions, or a letter to the complainant are not sufficient to interrupt the statute of limitations. If the cookie practice has been discontinued and five years have elapsed without interruption, the Litigation Chamber will dismiss the complaint on the grounds that it is time-barred.
Is a "Reject" button required on a cookie banner?
Yes. Non-strictly necessary cookies require explicit consent, which is lacking when the visitor can accept everything on the first screen but cannot reject everything. On October 19, 2026, the Litigation Chamber of the Data Protection Authority again ruled that this constituted a violation of the GDPR and the e-Privacy Directive, based on the report from the Cookie Banner Task Force of the European Data Protection Board. The “accept” and “reject” buttons must therefore appear side by side on the first level.
My cookie banner says that continuing to browse the site constitutes consent. Is that allowed?
No. Consent requires a clear, active action on the part of the visitor, as the Court of Justice ruled in the Planet49 ruling of October 1, 2019, regarding pre-checked boxes, and as the European Data Protection Board’s Guidelines 05/2020 explicitly state regarding scrolling and navigating. The Belgian Litigation Chamber rejected that banner in the Telenet (2021) and Rossel (2022) cases because two consents were inferred from a single click. Replace such a banner with a genuine choice.
Can I avoid a fine if I update my cookie banner after a complaint has been filed?
Often, yes, but not guaranteed. In the decisions of 2023, 2025, and 2026, the Litigation Chamber dismissed the cases without imposing a sanction each time because the banner had been modified prior to the decision, pursuant to dismissal ground B.6 of its dismissal policy. However, the violation is still established in the decision, and Article 100 of the Act of December 3, 2017, allows the Litigation Chamber to impose a reprimand, an order, or a fine when it deems it necessary or appropriate. So, amend your banner before a complaint is filed, not after.
Conclusion
The decision of October 19, 2026, teaches two things at once. In Belgium, a complaint filed with the Data Protection Authority becomes time-barred five years after the events in question, even when the delay is entirely attributable to the Litigation Chamber, meaning that a complainant seeking to have the violation established must remain vigilant. Furthermore, a cookie banner without an “opt-out” button on the first screen constitutes a violation of the GDPR and the e-Privacy Directive—a finding the Litigation Chamber has made for the third time without imposing a penalty, each time because the website had been brought into compliance prior to the decision. Those who update their banner today are not buying an exemption, but they are securing a strong starting position.
ICT Legal Guide is the knowledge platform of the Intellectual Property, IT Law, AI Law, Data Protection, and Media Law department at Everest Advocaten, led by Joris Deene. Our attorneys assist website operators in reviewing and updating their cookie banners and cookie policies, and represent companies and affected parties in complaint proceedings before the Litigation Chamber of the Data Protection Authority.
Dutch 
English