Skip to content
News · noyb - European Center for Digital Rights EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Where did all the “reject” buttons come from?!

Cookie Banners Where did all the “reject” buttons come from?!

Full text

Cookie Banners Where did all the “reject” buttons come from?! More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where did this trend come from? In March 2021, noyb scanned the web for illegal cookie banners and filed more than 700 complaints across Europe. A final scan shows a detailed assessment after 1.5 years: more than 50% of the sites have improved their banners, in many cases, without noyb ever contacting them. First round of complaints Second round of complaints Background and data collection. Using specially developed software, noyb scanned more than 3,600 websites in March 2021 and collected data on whether the consent banners on these sites violated the GDPR. Based on this data, more than 700 complaints were filed against the most visited pages whose banners had GDPR violations, like no "reject" button or misleading designs. This triggered a massive rethinking process among many banner software providers and websit

How it connects

451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Supreme Administrative Court Jun 27, 2022 Consent Cookies Supervision
449209 CE asks CJEU if GDPR one-stop-shop applies to ePrivacy cookie consent cases On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act… Jan 28, 2022 Consent Supervision Supervisory Authorities
KHO:2026:64 KHO: Consent required for cookies and web requests; no CJEU referral needed A media company that provides news services did not request user context for the placement and use of cookies or certain web requests on several websites it managed. In June 2023,… Supreme Administrative Court Aug 27, 2026 Consent IP Address Recipient
449212 CE upholds CNIL competence to fine Google €100M for cookies despite no lead authority role On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance… Mar 4, 2021 Supervisory Authorities Supervision Cookies
3 O 762/19 LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit… Sep 15, 2020 Consent Legitimate Interest Controllers
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervisory Authorities IP Address Supervision