noyb's 422 Cookie Complaints: What CMP Vendors Must Fix Now

Automated Complaint Filing as a Regulatory Force Multiplier

In May 2023, noyb deployed a custom-built scanning infrastructure to identify cookie consent violations across hundreds of European websites, filing 422 coordinated complaints with data protection authorities across the EU. This is not a conventional civil society campaign — it is a deliberate attempt to industrialize Art. 77 GDPR complaint mechanisms, forcing DPAs to act on consent violations at a scale that manual enforcement could never achieve. The strategic implication for Consent Management Platform (CMP) vendors — Cookiebot (Usercentrics), OneTrust, and Usercentrics standalone — is that their default configurations and UI patterns are now effectively under regulatory review simultaneously across 27 jurisdictions.

The complaints are grounded in Art. 5(1)(a), Art. 6(1), and Art. 7 GDPR, combined with national ePrivacy transpositions of Art. 5(3) ePrivacy Directive. The core allegation: cookie banners are designed to make rejection harder than acceptance, violating the requirement that consent be freely given, specific, informed, and unambiguous (Art. 4(11) GDPR). noyb's scanner specifically flagged patterns where the Accept All button appears in a visually dominant position or color, while Reject All requires navigating a secondary layer — a structural dark pattern documented in EDPB Guidelines 03/2022 on Dark Patterns (adopted March 2023).

What noyb's Scanner Actually Detects

Understanding the technical detection methodology matters for compliance teams. noyb's tooling performs headless browser crawls, examining the rendered DOM for CMP-injected consent UI components. Specific detection criteria include:

• Asymmetric button hierarchy: Primary CTA (Accept All) rendered with higher visual weight (background color, font-weight, z-index) versus a plain-text or ghost-button Reject equivalent.
• Pre-ticked checkboxes: Consent purposes initialized with checked=true in the HTML before user interaction — directly violating Art. 7(2) GDPR and Recital 32.
• Cookie placement before interaction: HTTP response headers or subsequent JavaScript calls setting non-essential cookies (detectable via Set-Cookie response headers and document.cookie writes) before the consent banner receives any user gesture.
• Legitimate Interest pre-selection: IAB TCF vendor purposes 2–10 activated by default under a legitimate interest legal basis that users must actively opt out of — a configuration the EDPB's TCF Opinion (Opinion 7/2023) explicitly questioned.

CMP vendors ship these configurations as defaults. The 422 complaints implicitly hold the website operators responsible under Art. 83(4)-(5) GDPR, but the underlying design choices originate with the CMP. This creates a liability chain that operators' DPAs are beginning to trace upstream.

Jurisdiction-Specific Enforcement Patterns

Because noyb filed in multiple jurisdictions simultaneously, the campaign exploits a structural weakness in the GDPR's one-stop-shop mechanism (Art. 60 GDPR): for cookie violations, competence typically rests with the user's member state DPA, not the controller's lead supervisory authority. This means a German website operator can face complaints processed by the Austrian DSB, the French CNIL, and the Spanish AEPD concurrently. The CNIL has historically been the most aggressive, with its 2022 enforcement wave generating over €210 million in cookie-related fines against Google, Facebook, and Microsoft. The Belgian DPA's 2022 ruling against IAB Europe (Case IE/2020/0024) established that the TCF Framework itself constitutes joint controllership — a precedent with direct relevance to CMPs acting as data processors or joint controllers under Art. 26 GDPR.

CMP Vendor Liability: Processor or Joint Controller?

The processor vs. joint controller question is commercially existential for CMP vendors. Under Art. 28 GDPR, a processor acts only on documented controller instructions. But when a CMP vendor ships a default configuration that pre-selects consent purposes or loads third-party vendor lists (IAB TCF Global Vendor List) independently of controller instruction, they are exercising independent decision-making over personal data processing — the definitional trigger for joint controllership under Fashion ID (CJEU C-40/17) and Wirtschaftsakademie (CJEU C-210/16).

Practically: if Cookiebot's default template initializes Google Analytics as a pre-consented vendor before the operator has reviewed or approved that configuration, the vendor has made an independent means-and-purposes decision. The Belgian DPA's IAB Europe ruling (upheld in part by the Brussels Court of Appeal in 2023) sets the template for this analysis. CMP vendors maintaining that they are mere processors face a weak argument under this jurisprudence.

Immediate Action Items for CMP Vendors and Their Clients

For CMP Vendors (Cookiebot, OneTrust, Usercentrics)

1. Audit default templates against EDPB Guidelines 03/2022: Every default configuration shipped to new customers must produce banners where Accept All and Reject All are visually equivalent — same button style, same interaction depth, same layer hierarchy.
2. Eliminate pre-ticked states at the SDK level: The consent object must initialize all non-essential purposes as false. Enforce this in the SDK, not as a documentation recommendation operators can override.
3. Block cookie firing until affirmative consent: The CMP must intercept document.cookie writes and navigator.sendBeacon calls from tag manager payloads (GTM, Tealium) until consent state is resolved. This requires Tag Blocking functionality to be enabled by default, not opt-in.
4. Reassess DPA agreements: If you are arguing processor status, your Data Processing Agreement under Art. 28(3) GDPR must explicitly prohibit the CMP from making independent determinations about vendor activation. Any deviation makes joint controller status the correct legal classification.

For Website Operators Using CMPs

1. Do not accept CMP defaults as legally compliant: Your controller obligations under Art. 5(2) GDPR (accountability) require you to verify the CMP configuration, not delegate compliance to the vendor. Document your configuration review in your ROPA (Art. 30 GDPR).
2. Test your banner technically: Use browser devtools Network tab to verify zero Set-Cookie headers containing non-essential identifiers (e.g., _ga, _fbp, IDE) arrive before a consent interaction. noyb's scanner does exactly this.
3. Run noyb's own detection criteria against your site: The NOYB Consent Banner Checker (available via noyb.eu tooling) replicates core scanner logic. Run it monthly. Integrate it into your CI/CD pipeline if your consent UI is dynamically rendered.

The Systemic Shift: Enforcement as Infrastructure

The 422-complaint campaign represents a transition from reactive to systematic GDPR enforcement. When a single organization can file hundreds of legally substantiated complaints using automated tooling, the effective enforcement capacity of the GDPR ecosystem multiplies without requiring proportional DPA resource increases. EDPB Chair Anu Talus acknowledged in 2024 that coordinated enforcement actions under Art. 62 GDPR represent a strategic priority — noyb's campaign is the civil society parallel to this institutional direction.

For CMP vendors, the compliance calculus has changed permanently. Shipping non-compliant defaults is no longer a low-risk business decision buffered by slow DPA processes. It is a systemic liability that now triggers coordinated, automated complaint generation across every jurisdiction where their platform deploys. The question is no longer whether their defaults will be scrutinized — it is which DPA will issue the first precedent-setting decision naming a CMP vendor as joint controller, and what the Art. 83(5) fine ceiling of 4% global annual turnover looks like applied to a platform deployed on hundreds of thousands of websites.