Belgium requires prior consent for any cookie that is not strictly necessary, under Article 10/2 of the Law of 30 July 2018, with the GDPR consent standard behind it. The Belgian Data Protection Authority (APD, in Dutch GBA) expects a "Reject all" button on the first layer as prominent as "Accept all", and has acted against misleading banners: its 2024 decision against Mediahuis ordered a first-layer reject option, though the Market Court annulled that decision in March 2025.
The Belgian Data Protection Authority, APD or GBA
Belgium's supervisory authority for data protection is the Autorité de protection des données (APD), known in Dutch as the Gegevensbeschermingsautoriteit (GBA). The APD oversees both GDPR enforcement and cookie-specific rules within Belgian territory.
The authority has been active on cookie compliance, mostly through orders and modest fines. It gained international attention for its February 2022 ruling against IAB Europe's Transparency and Consent Framework (TCF), which carried a EUR 250,000 fine.
Belgian cookie law: the ePrivacy transposition
Cookie consent in Belgium was originally governed by Article 129 of the Electronic Communications Act (Wet betreffende de elektronische communicatie, 13 June 2005), which transposed Article 5(3) of the EU ePrivacy Directive into Belgian law.
Following the Act of 21 December 2021, which transposed the European Electronic Communications Code, the cookie provisions moved from Article 129 to Article 10/2 of the Law of 30 July 2018 (the Belgian data protection law), in force since 10 January 2022. The substantive requirements remained the same: storing or accessing information on a user's device requires prior, informed, freely given, specific, and unambiguous consent.
Exemptions from consent
Two narrow exemptions apply. Cookies used solely to carry out a communication over an electronic network do not require consent. Cookies strictly necessary to provide a service explicitly requested by the user are also exempt.
Typical examples of exempt cookies include session identifiers like PHPSESSID, load-balancing cookies, and shopping cart cookies on e-commerce sites. Analytics cookies such as _ga, advertising cookies like _fbp, and social media widgets all require prior consent.
How Belgian cookie rules relate to the GDPR
The ePrivacy rules and the GDPR work in tandem. Article 10/2 of the Privacy Act governs whether you may place a cookie on the device. The GDPR governs what you do with any personal data collected through that cookie. In practice, the consent standard is the same: it must meet the GDPR Article 7 requirements.
The APD applies both frameworks simultaneously. A cookie banner that fails to offer a genuine reject option violates ePrivacy rules on consent. If the cookies in question also collect personal data, GDPR consent requirements apply on top.
This dual framework means Belgian enforcement can draw on both sets of rules when issuing fines.
APD enforcement against misleading banners
The APD has targeted deceptive cookie banner designs with increasing firmness. The most prominent case involved Mediahuis NV, operator of major Belgian news sites including De Standaard, Gazet van Antwerpen, Het Belang van Limburg, and Het Nieuwsblad.
In decision 113/2024 of 6 September 2024, following a complaint brought by noyb, the APD's Litigation Chamber ordered Mediahuis to add a reject option to the first layer of the banners on its four news sites and to stop using misleading colours, within 45 days. Each order carried a penalty of EUR 25,000 per day per site, capped at EUR 10 million in total.
The Market Court annulled that decision on 19 March 2025 (judgment 2024/AR/1690). As of October 2026, the decision therefore no longer binds Mediahuis, but it remains the clearest statement of what the APD expects from a banner, and it fits the wider EU view that dark patterns in cookie banners undermine consent.
What the APD expects from cookie banners
| Requirement | APD expectation |
|---|---|
| Reject option | A clear "Reject All" button on the first layer, equally prominent as "Accept All" |
| Button design | No misleading colours, sizes, or contrast to steer users toward acceptance |
| Granular choice | Users must be able to consent per cookie category (e.g. analytics, marketing) |
| Withdrawal | Withdrawing consent must be as easy as giving it |
| Pre-ticked boxes | Not permitted: consent must be an affirmative action |
| Cookie walls | Blocking access entirely unless cookies are accepted is not valid consent |
The IAB Europe TCF case started in Belgium
Belgium became the centre of a Europe-wide debate when the APD ruled in February 2022 that IAB Europe's Transparency and Consent Framework violated the GDPR. The APD found that TC Strings, the encoded records of user consent preferences, constituted personal data and that IAB Europe acted as a joint controller.
The case went through multiple court proceedings, including a reference to the Court of Justice of the EU (C-604/22, March 2024), which held that a TC String can be personal data and that IAB Europe can be a joint controller. In May 2025, the Belgian Market Court ruled on the remaining issues and, according to reports, limited IAB Europe's controllership to its own processing of those strings.
The TCF itself continues to operate. Version 2.3 has been mandatory since 28 February 2026: TC Strings created after that date without a disclosedVendors segment are invalid.
For website owners using a consent management platform that relies on the TCF, this saga underscores the importance of choosing a consent management platform (CMP) that records and stores consent independently, rather than relying solely on a TC String.
Belgium compared to neighbouring EU countries
Belgian cookie rules sit within the broader EU framework, but enforcement intensity and specific guidance vary by country. If your website targets visitors across the Benelux region or neighbouring states, compare the Belgian approach with these guides:
Cookie consent in the Netherlands: the Dutch AP has issued detailed cookie guidance and warned organisations about misleading banners.
Cookie consent in France: the CNIL has imposed some of the largest cookie-related fines in Europe, including multi-million euro penalties against major tech companies.
Cookie consent in Luxembourg: as a fellow Benelux state, Luxembourg's CNPD applies similar ePrivacy transposition rules.
Cookie consent in Germany: the TDDDG provides Germany's specific ePrivacy transposition, with the Federal Court (BGH) confirming opt-in consent requirements.
Checklist for Belgian websites
Use this checklist to verify your site meets current APD expectations. Each item reflects either explicit guidance from the APD or requirements drawn from enforcement decisions.
Display a cookie banner before any non-essential cookies are set.
Include equally visible "Accept All" and "Reject All" buttons on the first layer.
Avoid colour contrast tricks, oversized accept buttons, or other dark patterns.
Offer granular, per-category consent (analytics, marketing, functional) on a second layer.
Do not use pre-ticked checkboxes.
Make withdrawing consent as straightforward as giving it, with a persistent link or icon on every page.
Run a cookie scan to identify every cookie and tracker on your site.
Maintain a cookie policy listing each cookie's name, purpose, provider, type, and expiry.
Block non-essential scripts until consent is recorded.
If using Google Consent Mode v2, verify that default consent states are set to denied for Belgian visitors.
Short answers on Belgian cookie rules
Does Belgium require cookie consent for analytics cookies?
Yes. Analytics cookies such as _ga are not strictly necessary to deliver a service requested by the user, so they require prior opt-in consent under Article 10/2 of the Law of 30 July 2018 and the GDPR.
Can I use a cookie wall on a Belgian website?
The APD considers cookie walls, where site access is blocked unless all cookies are accepted, incompatible with freely given consent. Consent obtained through a cookie wall is unlikely to be valid.
What penalties has the Belgian APD imposed over cookie banners?
Most APD cookie cases have ended in orders and modest fines. In the Mediahuis decision of 6 September 2024, it set a penalty of EUR 25,000 per day per site for ignoring its orders, capped at EUR 10 million, but the Market Court annulled that decision on 19 March 2025.
Is a reject button mandatory on Belgian cookie banners?
The APD expects a clear reject option on the first layer of the banner, as prominent as the accept button, and ordered one in its 2024 Mediahuis decision. The EDPB's cookie banner taskforce took the same view in January 2023.
How does the IAB TCF case affect my website in Belgium?
The case confirmed that TC Strings can be personal data, and since 28 February 2026 only TCF v2.3 strings are valid for new consents. Keeping your own consent records, not only the TC String, gives you stronger evidence of each choice.
Put Reject all on your Belgian banner's first layer
If you are not sure which cookies your site sets, start with a scan. Kukie.io detects and categorises the cookies it finds, shows Reject all beside Accept all on the first layer and keeps a record of every choice. The global compliance hub covers the other countries your visitors come from.
