Yes, DDoS would be illegal in most countries. Picketing in the sense of peaceably assembling on public property outside the business and not harassing innocent bystanders or blocking egress or ingress of workers, customers, or suppliers would generally be fine. The online equivalent would probably be something like posting your complaints on social media.