In short
You may only place cookies if your visitor has given permission for this, except for functional cookies that are necessary for your website to work. You always set up this consent via a cookie banner, with a clear choice for accept, reject, and view purposes. A cookie wall, access only after accepting all cookies, is not allowed. Since 2024, the Dutch Data Protection Authority (AP) has been stricter in monitoring this.
What types of cookies do you use?
Cookies are files that a website places on the computer, smartphone, or tablet of your visitor. There are three types, each with different rules:
Functional cookies. Necessary for your website to work properly, such as remembering a shopping cart. These can always be placed without permission.
Analytical cookies. Measure visitor behavior, for example with Google Analytics 4. If they process little or no personal data, permission is not required. If they do, your visitor must first give consent.
Tracking cookies. Follow visitors across multiple websites and apps, often for targeted advertisements. This type most affects the privacy of your visitor. Therefore, only place these with explicit consent.
So first map out what type of cookies your website uses before arranging consent.
What legislation applies to cookies?
The rules for cookies are outlined in the General Data Protection Regulation (GDPR) and the Telecommunications Act. The main rule: you need your visitor's consent before placing non-functional cookies. Every cookie for which you ask permission must be mentioned in your cookie banner. A cookie wall is not allowed; your visitor must also be able to access the website without accepting all cookies.
What does the Dutch Data Protection Authority focus on?
Since 2024, the AP has been more actively monitoring cookie usage, especially the quality of cookie banners. Consider: is consent requested in a fair manner, and is rejecting as easy as accepting? Over the past two years, the AP has sent dozens of organizations warning letters requesting them to adjust their cookie banners. For persistent violations, the AP can also impose fines.
Do you know which cookies you use and why? Then you also know exactly what you need to arrange to avoid a warning letter.
In 3 steps to a compliant cookie banner
Map out your cookies
Create an overview of all cookies on your website. Note the type (functional, analytical, or tracking), the purpose, and what data is collected for each cookie.
Draft a cookie policy
Use your overview as the basis for a cookie policy: this outlines which cookies you use, why, and how long you retain the data. The AP provides more guidance on drafting a cookie policy on its website (opens in new tab).
Create a clear cookie banner
Include in the cookie banner all cookies for which you need consent. Provide your visitor with an equal choice between "accept" and "reject," and add an option "view purposes" where you explain what the data is used for.
Completed these 3 steps? Then your cookie banner complies with the GDPR, and you avoid the risk of a warning letter from the AP.
Get started with your cookie banner
Check today which cookies your website places and whether your cookie banner offers an equal choice between accept and reject. Then test your cookie banner against the 9 guidelines for clear cookie banners from the Dutch Data Protection Authority, with concrete examples of what to do and what not to do.
Frequently Asked Questions
Can I place my website behind a cookie wall?
Hide explanationShow explanation
Can I place my website behind a cookie wall?
No. A cookie wall, where visitors can only use the website after accepting all cookies, is not allowed. Visitors must also be able to visit the website if they reject cookies.
Do I need permission for functional cookies?
Hide explanationShow explanation
Do I need permission for functional cookies?
No. Functional cookies are necessary for your website to work and hardly infringe on the privacy of your visitor. These can always be placed without asking for consent.
What happens if the AP rejects my cookie banner?
Hide explanationShow explanation
What happens if the AP rejects my cookie banner?
For a first violation, the AP usually sends a warning letter requesting the cookie banner to be adjusted. For serious or persistent violations, the AP can impose fines or other sanctions.
More articles per topic
