Cookies on a Dutch Website: What the AP and ACM Expect

Short answer: Under Article 11.7a of the Dutch Telecommunications Act, you need clear information and consent before placing cookies, except for functional cookies and analytics cookies with little or no privacy impact. Tracking cookies always need consent, and because they usually process personal data the Autoriteit Persoonsgegevens (AP) also applies the GDPR. Since 2025 the AP has been warning hundreds of sites about misleading banners: accept and reject must sit on the same layer, rejecting must take no more clicks than accepting, and nothing non-essential may load before a choice.

The rules

The law: Article 11.7a Telecommunicatiewet

Article 11.7a(1) allows storing or reading information on a user's device only if the user has been given clear and complete information under the GDPR, at least about the purposes, and has given consent. Article 11.7a(3) exempts two cases:

storage solely to carry out the communication over the network;
storage that is strictly necessary to deliver the online service the user asked for, or, provided it has "no or minor consequences" for privacy, storage to obtain information about the quality or effectiveness of the service.

That second limb is the Dutch analytics exemption, and it's broader than the wording in several other EU countries. Article 11.7a(4) adds a presumption: tracking that collects, combines or analyses data about a user's use of different online services, so the user can be treated differently, is presumed to involve personal data.

Who checks what

The ACM (Authority for Consumers and Markets) explains the cookie rule to businesses on its consumer-sales pages: functional cookies may be placed without consent "as long as you say so"; low-impact analytics cookies likewise; privacy-sensitive analytics and tracking need consent; and pre-ticking choices "is forbidden."
The AP (Dutch Data Protection Authority) acts where cookies involve personal data, which covers tracking cookies and some functional and analytics cookies too. It's the AP that has been running the visible enforcement since 2025.

Analytics without consent: the conditions

Both regulators allow analytics without consent only when the privacy impact is minor. In practice that usually means:

first-party measurement used only to improve your own site;
no sharing of the data with the analytics provider for its own purposes;
no cross-site tracking or advertising profiles;
shortened or masked IP addresses and limited retention;
a processing agreement with the provider, and clear information in your cookie or privacy statement.

The AP's banner guidance notes that for functional and "limited analytics" cookies you can rely on legitimate interest instead of consent under the GDPR. A default setup of a large analytics suite, with data sharing and advertising features switched on, generally fails these conditions. If you're not sure your configuration qualifies, ask for consent.

What the AP's enforcement looks like

On 15 April 2025 the AP announced it had written to 50 organisations about misleading cookie banners, the first of 500 it planned to warn each year. It said it continuously monitors 10,000 Dutch websites, gives warned organisations three months to fix the problem, and otherwise opens an investigation with "a high risk of a fine." Examples in the letters included cookies placed before consent, tracking options pre-ticked, and reject buttons only visible lower down.

By 11 November 2025, the AP said it had warned more than 200 websites, that about three-quarters had adjusted their banners, and that it was taking enforcement steps against those that hadn't. The AP's chair also offered the simplest compliance route: if you stop intrusive tracking, "You don't need a cookie banner on your website."

Banner do's and don'ts

Based on the AP's guidance page "Heldere cookiebanners" and its warning letters.

Do

Ask before you place. Nothing beyond functional and qualifying analytics cookies loads until the visitor chooses.
Put accept and reject on the same layer. If accepting takes one click on the first screen, rejecting must too.
Use plain button words, such as "accepteren", "akkoord" or "weigeren". The visitor must understand they're giving consent, not just acknowledging they've read a notice.
Say on the first layer that you process personal data, for which purposes, and whether and with how many third parties you share it.
Make the reject button clearly visible and legible, with no scrolling needed if accepting doesn't need it.
Offer easy withdrawal, as easy as giving consent, for example through a floating button or a footer link that's always available.

Don't

Pre-tick boxes or switch sliders on by default.
Hide reject on a second layer or behind "settings."
Give reject a colour that barely differs from the background.
Use vague or steering wording ("Yes, I want the best experience!").
Bundle consent into your terms and conditions or privacy statement.
Place tracking cookies "on legitimate interest." Tracking needs consent.

A quick self-check

Open your site in a private window and look at the cookies set before you click anything.
Click "weigeren" (or your English reject) and reload: are any tracking or ad cookies present?
Count clicks: is rejecting ever harder than accepting?
Check embeds (YouTube, maps, chat, social pixels) load only after consent.
Read your first layer aloud: does it say what data, which purposes and how many third parties?

This is general information about Dutch rules, not legal advice for your organisation.

FAQ

Do I need a cookie banner if I only use privacy-friendly analytics?

Not for consent, if your analytics genuinely have minor privacy impact and you only use functional cookies otherwise. You still have to tell visitors which cookies you place, typically in a cookie statement linked from the footer.

Does the 11.7a rule apply to apps and pixels, not just cookies?

Yes. It covers any storage of, or access to, information on the user's device, so tracking pixels, local storage, SDKs and fingerprinting techniques fall under it as well.

Do I need a two-layer banner?

Not always. The AP says a second layer can be appropriate if you process a lot of personal data for many purposes, but the first layer must already say that you process personal data, for what purposes, and whether you share it with third parties and how many.

Will a small business really be checked?

The AP monitors thousands of sites automatically and picks those likely to break the rules. Size isn't the filter; a misleading banner is.

If you'd like your banner and tags set up so the reject button actually blocks tracking, send us your site address.