In the Netherlands you may only place or read cookies on a visitor’s device after clear information and prior consent, unless the cookie is strictly necessary for the service the visitor asked for. That rule is in Article 11.7a of the Telecommunications Act (Telecommunicatiewet, Tw), which implements the EU ePrivacy Directive; one narrow exception covers analytics with no or minor privacy impact. Where cookies process personal data, the GDPR applies on top, enforced by the Dutch Data Protection Authority (Nizozemski organ za zaštitu podataka, AP).
The consent requirement applies whether or not the information stored is personal data. The GDPR then adds rules on the quality of the consent and on what you may do with the data afterwards. This page explains which cookies need consent, what a compliant banner looks like, how analytics and advertising fit in, and who enforces the rules.
Which cookies need consent?
All cookies and similar techniques need consent under Article 11.7a(1) Tw, except those listed in Article 11.7a(3) Tw. The rule covers any storage of or access to information on the user’s device, so tracking pixels, local storage and device fingerprinting are covered as well as classic cookies.
Which cookies are exempt?
Article 11.7a(3) Tw exempts storage or access that is used only to carry out communication over the network, or that is strictly necessary to provide the service the user requested. Typical examples are cookies for a shopping basket, a login session, load balancing and security.
The same paragraph exempts cookies used to obtain information about the quality or effectiveness of the service, provided they have no or only minor consequences for the user’s privacy. That is the analytics exception, discussed below. Even for exempt cookies you must explain in your cookie policy what they do.
When are cookies personal data?
Under Article 11.7a(4) Tw, cookies used to collect, combine or analyse data about a user’s use of different online services so that the user can be treated differently are presumed to involve the processing of personal data. In practice that covers almost all tracking and advertising cookies.
Once personal data is involved, you also need a legal basis under the GDPR, a privacy notice, a processing agreement with your processors, and records of the consent you obtained.
What makes consent valid?
Consent must be freely given, specific, informed and unambiguous, given by a clear active step, and as easy to withdraw as to give. Pre-ticked boxes, silence and continued browsing do not count.
Article 11.7a(1)(a) Tw requires clear and complete information in line with the GDPR, in any event about the purposes for which the information is used. Tell the visitor which categories of cookies you use, which third parties receive data, and how long cookies stay on the device.
What does a compliant cookie banner look like?
The AP takes the view that refusing must be as easy as accepting. “Accept” and “reject” belong on the same layer, with equal prominence; a reject option hidden behind “settings” or a second page is a common reason for enforcement.
- no non-essential cookie or script fires before the visitor has made a choice;
- separate choices per category, for example analytics and advertising;
- all optional categories switched off by default;
- a link to the cookie policy and a permanent “cookie settings” link to change or withdraw consent;
- a consent log showing when consent was given, for what, and on the basis of which banner version.
Can you use a cookie wall?
For websites of public-law bodies, Article 11.7a(5) Tw prohibits making access dependent on consent. For private websites, the AP considers that a cookie wall forcing visitors to accept tracking cookies does not produce freely given consent, so offer access without tracking.
How long may a cookie last?
Neither the ePrivacy Directive nor the Tw sets a maximum lifetime. The GDPR principles of purpose limitation and storage limitation require that the lifetime is proportionate to the purpose, and you must state it in your cookie information before consent.
Do analytics cookies need consent?
Usually yes. The analytics exception in Article 11.7a(3)(b) Tw only applies if the cookies are used solely to measure the quality or effectiveness of your own service and the impact on privacy is nil or minor.
The AP applies this narrowly. In practice the configuration must ensure that the analytics provider does not use the data for its own purposes, that IP addresses are shortened or otherwise masked, that data is not combined with other services or used for advertising, and that a processing agreement is in place. A standard installation of a commercial analytics package rarely meets these conditions, which is why most Dutch websites ask consent for analytics.
If visitors refuse, your analytics must not load. Build that into your tag manager, not only into the banner text.
What applies to advertising cookies and trackers?
Advertising, retargeting and social media tracking always require prior consent under Article 11.7a(1) Tw, and they are presumed to involve personal data under Article 11.7a(4) Tw. This applies to first-party and third-party cookies alike, and to pixels, conversion tags and similar techniques.
You remain responsible for what you allow third parties to place through your website. Check your contracts with ad networks and platforms: in many set-ups you and the platform are joint controllers, which requires an arrangement on each party’s responsibilities under the GDPR. Profiling based on special categories of data, such as health or political opinions, requires explicit consent.
What must your cookie and privacy policy say?
Vaš Izjava o privatnosti and cookie policy together must give the information that Article 11.7a(1)(a) Tw and the GDPR require. List each cookie or category, its purpose, its lifetime, whether it is first-party or third-party, and which recipients get the data.
Vague purposes such as “to improve your experience” are not enough. Update the policy whenever you add tags or change tools, and ask fresh consent where the purposes change.
Who enforces the cookie rules, and what are the sanctions?
The Tw and the GDPR each have their own supervisor. Under Article 15.1(3) Tw the Authority for Consumers and Markets (ACM) supervises the Tw provisions not assigned to others, which includes Article 11.7a; under Article 15.4(2) Tw it can impose a fine of up to €900,000 or, if higher, 1% of turnover.
Where cookies involve personal data, which Article 11.7a(4) Tw presumes for tracking, the AP enforces the GDPR. GDPR fines are linked to worldwide annual turnover and can be far higher than the Tw fines. Both supervisors can also impose an order subject to a penalty payment (last onder dwangsom), which in practice forces a quick change of the banner.
Is new EU cookie legislation coming?
The proposed EU ePrivacy Regulation, meant to replace the ePrivacy Directive, has not been adopted. Article 11.7a Tw therefore remains the operative rule in the Netherlands; check any claim about new cookie rules against the current legislative file before acting on it.
Kada vam je potrebna DPIA?
The GDPR requires a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to individuals, such as large-scale profiling or combining tracking data from several sources. Record the purposes, the legal basis, the risks and the mitigating measures, such as pseudonymisation and short retention periods.
If a DPIA shows a high risk that you cannot mitigate, you must consult the AP before you start the processing.
What should you check as a website owner?
- Run a cookie scan in a clean browser profile: what fires before the visitor makes a choice?
- Are “accept” and “reject” on the first layer with equal prominence, and are optional categories off by default?
- Does your analytics configuration really meet the conditions of the exception in Article 11.7a(3)(b) Tw, or do you need consent?
- Do you have processing or joint-controller agreements with your analytics and advertising partners?
- Can visitors withdraw consent at any time through a permanent link, and is every consent logged?
- Does your cookie policy match the cookies that actually load?
In most audits the gap is not the policy text but the tag manager: a script that loads on page view regardless of the visitor’s choice. Fix the loading order first, then the wording.
What can we do for you with cookies and online advertising?
We advise companies in the Netherlands on cookie compliance as part of our work as odvjetnik za zaštitu privatnosti.
- We review your cookie banner and consent flow against Article 11.7a Tw and the AP’s guidance.
- We draft or update your cookie policy and privacy policy.
- We review and negotiate processing and joint-controller agreements with analytics and advertising partners.
- We carry out or review a DPIA for new tracking or profiling tools.
- We respond on your behalf to questions, investigations or draft decisions of the AP or the ACM.
Rezime
- Under Article 11.7a Tw, cookies and similar techniques need prior information and consent, unless strictly necessary or used for low-impact analytics.
- Tracking cookies are presumed to process personal data, so the GDPR applies as well.
- Refusing must be as easy as accepting; pre-ticked boxes and continued browsing are not consent.
- Most out-of-the-box analytics set-ups need consent; advertising cookies and pixels always do.
- The ACM enforces Article 11.7a Tw (fines up to €900,000 or 1% of turnover); the AP enforces the GDPR.
Često postavljana pitanja
Do I need consent for Google Analytics or similar tools?
Usually yes. The exception in Article 11.7a(3)(b) Tw only covers analytics with no or minor privacy impact, which requires a privacy-friendly configuration and a processing agreement. A standard set-up rarely qualifies.
Do strictly necessary cookies need consent?
No. Cookies that are strictly necessary for the service the visitor requested, such as a shopping basket or login session, are exempt under Article 11.7a(3) Tw. You must still explain them in your cookie policy.
May I hide the reject button behind a settings page?
The AP considers that refusing must be as easy as accepting, so accept and reject belong on the same layer with equal prominence. A hidden reject option is a common reason for enforcement.
Do tracking pixels fall under the cookie rules?
Yes. Article 11.7a Tw covers any storage of or access to information on the user’s device, so pixels, tags, local storage and fingerprinting need consent just like cookies.
Who can fine me for a non-compliant cookie banner?
The ACM supervises Article 11.7a Tw and can fine up to €900,000 or 1% of turnover. Where personal data is processed, the AP can also act under the GDPR, with fines linked to worldwide turnover.
