EDPB Cookie Banner Standards Target Hidden Rejection Options and Invalid Consent

European data protection authorities coordinated their approach to cookie-banner complaints filed by privacy organisation noyb, targeting practices that undermine valid consent. The European Data Protection Board’s Cookie Banner Taskforce report, adopted on 17 January 2023, confirms that pre-ticked opt-in boxes do not establish valid consent. Most participating authorities also considered banners offering acceptance without a rejection option on the same layer incompatible with valid consent. The report addresses deceptive designs, non-essential cookies misclassified as essential, and inappropriate reliance on legitimate interests. National laws implementing the ePrivacy Directive govern cookie placement and reading, while the GDPR governs subsequent processing of personal data.

Organisations should review acceptance and rejection choices, cookie classifications, and consent-withdrawal mechanisms: withdrawal must remain accessible at any time and be as easy as granting consent, although the report mandates no particular interface. These positions establish a minimum assessment threshold, not blanket approval of any banner design; national requirements and case-specific scrutiny still apply. In a separate account describing a draft as not yet final, noyb reported banner improvements following its complaints and a court challenge against the Bavarian Data Protection Authority over its refusal to act against an allegedly deceptive banner. That account highlighted unresolved questions about button colours, contrast, and withdrawal-control placement; the official report confirms that an adopted taskforce position exists.