On 19 October 2026, the Litigation Chamber of the Belgian Data Protection Authority (DPA) issued decision no. 285/2026 on a complaint filed in 2020 against a Belgian company's website. It rules that a banner with no “reject all” button on its first layer does not secure valid consent. The site had been corrected before the decision, so no sanction followed. For any Belgian business, the signal is clear.
1. What the DPA decided
According to Kortlex, the complaint dates from 11 May 2020. It argued that the site did not let visitors refuse cookies and treated browsing as consent. Facts before 7 September 2020 are time-barred: the law sets a five-year limit.
For the following period, the Litigation Chamber found that the banner showed only an “accept all” button on its first layer. According to Kortlex, it sees this as undermining freely given consent under the GDPR, relying on the report of the European cookie banner taskforce.
2. No sanction, but a recorded infringement
According to the law firm Everest Advocaten, by 6 October 2026 the banner carried both buttons, accept and reject, on its first layer. The Chamber therefore closed the case with no sanction and no corrective measure.
The same firm stresses that the infringement remains in the reasoning of the decision. A late fix can avoid a fine. It does not erase the finding, and the DPA keeps its powers in case of persistent or repeated infringements.
3. Six years for one complaint
The case shows how long these procedures run: a complaint in May 2020, a decision in October 2026. According to Everest Advocaten, the complainant maintained the complaint in 2025, saying their preferences were not saved correctly.
A site fixed in a hurry can therefore stay exposed on a second point: the visitor's choice must actually be honoured by the site, not just displayed.
4. What this means for your campaigns
A non-compliant banner also weakens advertising measurement. If consent is not valid, the data behind your Google or Meta campaigns rests on a questionable basis.
The issue therefore touches legal, website and advertising at once. It is best handled before a complaint arrives, not after.
The AI lens, humans first
AI can scan a site in minutes, spot banners with no reject button and check whether tracking cookies are set before any click. It cannot tell you which consent set-up suits your activity, or what risk your company accepts. That decision stays human, with legal advice if doubt remains. AI executes. Expertise decides, and keeps watch.
This week
Open your site in a private window and look at the first layer of the banner: the “accept” and “reject” buttons should sit side by side, with the same visual weight. Then check that no tracking cookie is set before the visitor chooses, and that a refusal is remembered on the next visit. Note the result and ask your web provider to fix any gap.
Vistalaro Build configures consent banners on WordPress and custom-built sites, with refusal at the same level as acceptance and choices that are genuinely honoured, on EU servers. Vistalaro Reach checks that the tracking behind your Google and Meta campaigns rests on valid consent, so that your measurements stay usable. Vistalaro Pilot puts a senior marketer at your side to weigh compliance, measurement and performance, and to sequence the fixes.
Does your cookie banner offer a real “reject” button?
Check it this week: a ten-minute review costs less than a case before the DPA.
Let's talk