Luxembourg's cookie rules come from one law and one set of guidelines. Article 4(3)(e) of the amended law of 30 May 2005 requires consent before non-essential cookies are stored or read, and the CNPD's cookie guidelines, in their version of 3 January 2022, explain how to collect that consent. The CNPD (Commission nationale pour la protection des données) is Luxembourg's data protection authority. Portugal's regulator uses the same acronym, so if you were looking for Portugal, see the Portuguese CNPD guidelines.
Luxembourg's cookie consent legal framework
Luxembourg transposed Article 5(3) of the ePrivacy Directive (2002/58/EC) through the loi du 30 mai 2005 on privacy in electronic communications, later amended to carry the consent rule of Directive 2009/136/EC. The cookie rule sits in Article 4(3)(e) of the amended law: consent is needed before a cookie is placed or read, unless the cookie only carries a communication or is strictly necessary for a service the visitor asked for.
The CNPD enforces both this national law and the GDPR. Its cookie guidelines apply to websites and mobile applications alike.
The two instruments work together. Where a cookie processes personal data, the amended law of 30 May 2005 and the GDPR apply at the same time, and the consent itself must meet the GDPR's conditions in Articles 4(11) and 7.
What the CNPD cookie guidelines require
The guidelines draw a clear line between essential cookies, which need no consent, and non-essential cookies, which do.
The CNPD's own examples of essential cookies are wider than many site owners expect. Cookies that store the visitor's cookie choice, a shopping basket, form answers, authentication (when used only for that) and security against fraud need no consent. So do cookies that personalise the service, such as a display format or a language setting. Personalised advertising never falls into this group.
Analytics is where Luxembourg is stricter than some neighbours. The CNPD accepts that first-party audience measurement poses limited risk, but still says the site operator must obtain consent before placing analytics cookies such as _ga. Advertising pixels like _fbp, profiling, geolocation and social plugins that use cookies all need prior, informed, freely given, specific and unambiguous consent. This mirrors the approach of other EU authorities, such as the CNIL in France and the German authorities.
Cookie categories under CNPD guidance
| Cookie category | Examples | Consent required? |
|---|---|---|
| Strictly necessary | PHPSESSID, authentication tokens, CSRF tokens, the consent cookie | No |
| Service personalisation | pll_language, display format, theme selectors | No, when used only for that purpose |
| Analytics | _ga, _ga_<container-id> | Yes, even first-party |
| Advertising and tracking | _fbp, _gcl_au, retargeting pixels | Yes |
Cookie banner design: the two-level approach
The CNPD recommends giving information in two levels.
The first level is the banner or pop-up. At a minimum, it should tell visitors that cookies are used, for which purposes, whether they are the site's own or third-party cookies, how to accept or refuse, that consent can be withdrawn at any time, and what refusing changes. The CNPD strongly recommends offering the same options for refusing as for accepting. If the first layer has an "Accept all" button, the guidelines say a similar "Refuse all" button should sit beside it, and refusing should take no more clicks than accepting. Closing the banner or doing nothing counts as a refusal. The guidelines also list misleading designs to avoid, the dark patterns that steer visitors toward accepting.
The second level is a detailed cookie policy, reachable from the banner. It must give the information required by Articles 12 and 13 of the GDPR: the purposes, the controller and any third parties, the data collected and its recipients, and how long each cookie lasts.
The CNPD recommends that consent last no longer than 12 months before you ask again. Within that period, it recommends not asking again unless something significant changes, such as a new advertising partner, new categories of data or a new purpose.
CNPD enforcement after the Amazon ruling
For five years, Luxembourg's place in GDPR enforcement rested on one decision. In July 2021, the CNPD fined Amazon €746 million for processing personal data for targeted advertising without a valid legal basis. The Administrative Tribunal upheld the decision on 18 March 2025.
That fine no longer stands. On 12 March 2026, the Cour administrative annulled the CNPD's decision and the fine on appeal. It largely confirmed the analysis of the infringements, but found shortcomings in the decision and sent the case back to the CNPD to reassess the sanction. As of October 2026, no new fine has been announced.
Smaller cases continue. On 6 January 2025, the CNPD fined a credit institution €175,000 for failing to answer access requests within the deadlines in Article 12(3) and (4) of the GDPR.
The CNPD also has a new power. Since 25 November 2025, a law of 20 November 2025 amending the Consumer Code lets the CNPD, as a qualified entity, bring collective actions where several consumers are harmed by a business that breaks data protection rules.
How Luxembourg's rules compare to neighbouring countries
Luxembourg's cookie rules follow the common EU framework, but each neighbour adds its own interpretation. The Belgian APD follows a similar two-layer model. In the Netherlands, the cookie rule in the Telecommunications Act is enforced by the ACM, while the AP handles the GDPR side, as the guide to Dutch cookie rules explains.
France's CNIL has been the most active on cookie-specific fines, including several against large technology companies. In Germany, the TDDDG (formerly the TTDSG) carries the cookie rule, and the state data protection authorities enforce it for websites.
| Country | Who enforces the cookie rule | ePrivacy transposition |
|---|---|---|
| Luxembourg | CNPD | Amended law of 30 May 2005, Article 4(3)(e) |
| Belgium | APD/GBA | Law of 13 June 2005 on electronic communications |
| France | CNIL | Loi Informatique et Libertés |
| Germany | State data protection authorities | TDDDG (formerly TTDSG, 2021), section 25 |
| Netherlands | ACM (cookie rule), AP (GDPR) | Telecommunicatiewet, Article 11.7a |
Checklist for a Luxembourg cookie banner
Use this checklist to compare your website with the CNPD's guidelines.
Audit your cookies. Run a cookie scan to find every cookie and tracker on your site, including those set by third-party scripts.
Classify each cookie. Put every cookie in the right category: strictly necessary, personalisation, analytics or advertising.
Block non-essential cookies before consent. No analytics or advertising cookie should fire until the visitor makes a choice.
Make refusing no harder than accepting. If "Accept all" is on the first layer, put a similar "Refuse all" next to it.
Provide category controls. Visitors should be able to accept or refuse cookies purpose by purpose, not just all or nothing.
Publish a detailed cookie policy. The second level must list each cookie, its purpose, duration and the party responsible.
Keep proof of consent. Store a record of when and how each visitor gave or refused consent.
Ask again after 12 months at most. The CNPD recommends this as the longest validity for a choice.
Make withdrawal easy. If consent took one click, withdrawing it should too, for example through a link in the footer or a floating icon.
Questions about cookie consent in Luxembourg
Does Luxembourg require cookie consent for analytics cookies?
Yes. The CNPD's guidelines say that even first-party audience measurement cookies, such as _ga, need the visitor's consent before they are placed.
How often must cookie consent be renewed in Luxembourg?
The CNPD recommends that consent last no longer than 12 months, after which you ask again. This is a recommendation in the guidelines, not a limit written into the law.
What fines can the CNPD impose for cookie violations?
The CNPD enforces both the amended law of 30 May 2005 and the GDPR, whose fines reach up to €20 million or 4% of annual worldwide turnover, whichever is higher. Its €746 million fine against Amazon was annulled on appeal in March 2026 and sent back to the CNPD to reassess.
Is a cookie banner mandatory for websites targeting Luxembourg?
Yes, if the site places non-essential cookies. Any website that places them on the devices of visitors in Luxembourg needs a way to collect valid consent before those cookies are set.
Can I use a cookie wall in Luxembourg?
Not for non-essential cookies such as behavioural advertising. The CNPD's guidelines say a cookie wall that makes access depend on accepting those cookies does not collect valid consent.
Do the Luxembourg cookie rules apply to mobile apps?
Yes. The CNPD's guidelines cover websites and mobile applications. Any app that stores or reads information on a device for non-essential purposes follows the same consent and information rules.
Set up a banner that matches the CNPD's two levels
Scan your site, review the cookies it finds and publish a banner with "Accept all" and "Refuse all" side by side. Kukie.io handles geo rules, consent logging and script blocking, so Luxembourg visitors see the right choice and their answers are recorded.
