The Personal Data Authority (AP) launched 5 investigations into cookie banners of Dutch websites in 2024. In all cases, the organizations with these websites violated the law. After the AP intervened, the organizations modified the cookie banners so that their websites do comply with the law.
Since 2024, the AP has been checking more frequently whether organizations on websites properly ask permission to place (tracking) cookies or other tracking software. Following complaints, the AP investigated frequently visited websites in various sectors, such as the financial sector, the media and the hospitality industry.
AP chairman Aleid Wolfsen: 'You visit a website for information, for example, or to buy something. You should be able to do that freely. If companies or other organizations want to track visitors to their website and sell their data to advertisers or data traders, for example, they must ask permission to do so. This must be done clearly and openly, without tricks that make it difficult for visitors to say "no. Too often, we still see organizations use these kinds of methods anyway. As a result, website visitors are tracked without their consent, and their data can be traded.'
The 5 organizations surveyed did ask permission to place cookies and other tracking software, but not properly. For example, the button to refuse cookies was hidden, or consent was already pre-ticked. In some cases, the websites were already placing cookies before the visitor had given consent, or even after the visitor had refused cookies.
To use cookies that track visitors across different Web sites, organizations must always ask permission. But a cookie banner is not always required. If a website only uses strictly necessary (functional) cookies, the organization does not have to ask permission. For example, if a Web shop uses cookies only to remember which products are in the visitor's shopping cart.
Wolfsen: 'So it's very easy: don't follow your visitors, and you don't have to worry about designing a cookie banner. And you don't irritate your visitors with it.'
For organizations that do want to use cookies or similar techniques, the AP has put together a set of rules of thumb to help organizations comply with the rules.
Wolfsen: "Smaller organizations in particular are often unaware of any harm. They receive a cookie banner from the website builder and assume it's fine. Unfortunately, this is often not the case. And not the website builder, but the owner of the website is responsible for this. So always check the rules of thumb on the AP's website when you have a website built. And discuss this in advance with your website builder.'
In the coming years, the AP will structurally monitor the state of cookie banners in the Netherlands. We will do this by constantly and automatically scanning the cookie banners of 10,000 websites to check whether they are clear enough. Organizations that do not comply with the law are first given a warning and the chance to adjust the cookie banner. In serious violations or if an organization refuses to adjust the cookie banner, there is a good chance that the AP will take enforcement action with fines or other sanctions.
