Cookie consent in Netherlands

Cookie compliance in the Netherlands sits on two pillars. Article 11.7a of the Telecommunicatiewet is the operative 'cookie law': it implements the EU ePrivacy Directive and prohibits storing information on, or reading information from, a user's terminal equipment without prior consent. The provision carves out cookies needed purely to transmit a communication, cookies strictly necessary for a service the user requested, and (since a later amendment) certain website-quality statistics that have little or no privacy impact.

Whenever a cookie processes personal data, the consent itself must satisfy the GDPR. The Uitvoeringswet AVG (UAVG) gives the GDPR domestic effect in the Netherlands, so 'consent' under Article 11.7a inherits the GDPR definition: a freely given, specific, informed, and unambiguous indication of the user's wishes through clear affirmative action. That is why a Dutch banner has to do more than display a notice.

In practice this means the legal questions split cleanly: the Telecommunicatiewet decides whether you needed consent at all, and the GDPR (via the UAVG) decides whether the consent you collected was actually valid.

The Autoriteit Persoonsgegevens has made cookie banners an active enforcement priority. In 2024 it opened five investigations into organisations that had failed to obtain tracking-cookie consent correctly, and in April 2025 it published a concrete set of rules for clear cookie banners and sent warning letters to the first 50 organisations, including retailers, media companies, and insurers, giving them three months to fix non-compliant banners or face formal investigation and fines.

The AP has signalled this is not a one-off campaign. It intends to structurally and largely automatically monitor cookie banners across the Dutch web, targeting on the order of 10,000 websites over time at roughly 500 per year. Common failures it flags are an absent or buried reject option, pre-ticked boxes, misleading design, and trackers that fire before any choice is made.

Separately, the AP has been clear that cookie walls, where a visitor is denied access unless they accept tracking, do not produce valid consent because the choice is not free. Conditioning access on acceptance of non-essential cookies is therefore treated as a breach.

The recurring enforcement theme is the gap between what a banner promises and what the page actually does. A banner can look compliant while analytics, advertising pixels, or social widgets quietly set cookies the moment the page loads, before the visitor clicks anything. Under Article 11.7a that pre-consent firing is exactly what the law prohibits, and it is what automated monitoring is designed to detect.

CookieSentry loads your live pages the way a real Dutch visitor would and flags every cookie and tracker that fires before consent, naming the source so you can see precisely which scripts breach Article 11.7a. The free public scan needs no signup, and the exportable report plus PDF evidence give you a record of what was firing and when.

Alongside the scan, CookieSentry generates GDPR documents such as privacy and cookie policies localized to national requirements. It is not a consent banner or CMP: keep the banner you already run, and use CookieSentry to verify that nothing fires before consent and to back it with documentation aligned to Dutch expectations.