Cookies and GDPR for your website: what really has to be in place?

Almost every website uses cookies, and almost every business owner wonders what exactly has to be in place. The short version: for cookies that track visitor behaviour you need prior consent, and that consent must be a real choice. In this article we set out what the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) says about this and which other GDPR basics your website needs. This is general information, not legal advice.

Which cookies are there?

The AP broadly distinguishes three groups:

• Functional cookies: needed to make the website work, for example to remember what is in the shopping basket or to handle security.
• Limited analytical cookies: measure how the website is used, with little impact on privacy.
• Tracking cookies: follow visitors across multiple websites, for example for personalised ads or building profiles.

For tracking cookies, consent is mandatory. For functional and limited analytical cookies, the AP says you can instead rely on a legitimate interest, as long as you carry out a balancing test and can demonstrate it. Visitors must then be able to object easily and you must still inform them clearly.

Why tracking cookies always involve personal data

You may think: I do not know my visitors' names, so what is the problem? The AP explains that placing and reading tracking cookies always collects other data, such as IP addresses and data about previously visited sites, and that this is personal data because it is indirectly identifiable. Even if you anonymise it immediately, the anonymisation is itself processing that requires consent. And pseudonyms remain personal data.

What is valid consent?

Under the GDPR and according to the AP, consent is only valid if it is given freely, specifically, informed and unambiguously. In practice this means:

• You may not place tracking cookies before the visitor has consented, or after they have refused.
• Visitors must be able to refuse.
• There must be an active act, such as a click on “Accept”.
• You must say how consent can be withdrawn again.

The AP gives as examples of invalid consent: a cookie wall where refusing means you cannot use the site normally, continuing to scroll or click after a notice, merely referring to the privacy policy, and pre-ticked choices on a deeper layer of the banner. A cookie wall is generally not allowed under the GDPR.

The 9 rules of thumb for a clear cookie banner

The AP has published nine rules of thumb. In our own words:

1. Say which personal data you process and for what purpose, before anyone chooses.
2. Do not pre-tick boxes or sliders.
3. Use clear words on the buttons, such as “Accept” and “Refuse”.
4. Put the accept and refuse choices on the same layer.
5. Do not hide the refuse button, for example through low visibility or by requiring scrolling.
6. Do not make anyone click extra to refuse.
7. Do not hide refusing as a small link in a block of text.
8. Make withdrawing consent as easy as giving it.
9. Do not confuse consent with legitimate interest. For personalised advertising, legitimate interest is not a valid basis.

Do you use a cookie banner tool (a CMP) that does not allow this? The AP states this does not relieve you of your own responsibility. You then have to ask the vendor for changes or switch.

Stricter supervision since 2024

The AP writes on its website that since 2024 it checks more strictly and more often whether websites ask for consent for cookies and other tracking software in the right way. So it is wise not to wait for a letter from the regulator before correcting your banner.

Social media buttons and videos

The AP gives a practical tip: if you only want a few social media buttons on your website, you can use inactive (“grey”) buttons that only place cookies after the visitor clicks them. Videos can also often be embedded without the player placing cookies, for example via the privacy-friendly embed option some video platforms offer. That way you have less to ask for.

More than cookies: GDPR basics for every website

Cookies are only part of the story. As soon as your website processes personal data, for example through a contact form, newsletter or web shop, the following basic requirements from the GDPR apply:

• A legal basis. You must be able to say on what ground you process data, such as consent, a contract or legitimate interest.
• A privacy statement. Say in plain language which data you collect, why, how long you keep it, who you share it with and what visitors' rights are.
• Security. You must protect the data properly, for example with HTTPS, updated software and restricted access.
• Data processing agreements. If you use outside parties that process personal data on your behalf, such as a mailing tool or hosting provider, you put the arrangements in writing.
• Data minimisation. Only ask for data you really need. Does a contact form need a phone number if email will do?
• Data breaches. In many cases you must report a personal data breach to the AP within 72 hours. This is in Article 33 of the GDPR.

Practical steps

1. Take stock of which cookies and scripts your site currently places. The AP points to a free website audit from the European Data Protection Board that shows this.
2. Remove everything you do not need: old pixels, unused trackers, widgets.
3. Choose privacy-friendly analytics or a setup that does not require consent, and justify that choice.
4. Set up a banner following the nine rules of thumb and test that nothing is placed before agreement.
5. Write a clear privacy statement and link to it in the footer and next to forms.
6. Record what you decided and why, so you can demonstrate it.

In conclusion

A good cookie and privacy approach is mostly a matter of design: collect little, ask honestly and record it properly. At CUBO Agency we build websites in which this is included from the start. Want us to review your current site for cookies and scripts? Get in touch for a free intro call. More reading: accessible website and the EAA.

Sources

Reviewed on 28 October 2026 against the sources below. Rules and guidelines change; this article is general information, not legal or tax advice.

• Heldere cookiebanners (Autoriteit Persoonsgegevens)
• Trackingcookies (Autoriteit Persoonsgegevens)
• AP: veel websites vragen op onjuiste wijze toestemming voor plaatsen tracking cookies (Autoriteit Persoonsgegevens)
• Verordening (EU) 2016/679, Algemene verordening gegevensbescherming (EUR-Lex)

Book an intro call