Netherlands cookie consent under the AP's banner rules

Websites with Dutch visitors need consent before placing any cookie that is not strictly necessary or a low-impact analytics cookie, under Article 11.7a of the Telecommunicatiewet. Two regulators share the work: the Authority for Consumers and Markets (ACM) enforces Article 11.7a, and the Autoriteit Persoonsgegevens (AP) enforces the GDPR for the personal data tracking cookies collect. The AP's banner guidance asks for "Reject all" next to "Accept all" on the first layer, and in April 2025 it began warning 500 organisations a year about misleading banners.

The Dutch cookie framework: two laws, two regulators

Cookie consent in the Netherlands sits at the intersection of two legal instruments. The Telecommunicatiewet (Telecommunications Act), specifically Article 11.7a, transposes the EU ePrivacy Directive into Dutch law and governs how cookies and similar tracking technologies may be placed on a visitor's device. The GDPR then applies to any personal data collected through those cookies.

Article 11.7a has been in force since June 2012. It requires that before placing or reading data on a user's terminal equipment, a website must provide clear, comprehensive information about the purposes involved and obtain the user's consent.

Supervision is split. The Autoriteit Consument & Markt (ACM, the Authority for Consumers and Markets) enforces Article 11.7a of the Telecommunicatiewet. The Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, enforces the GDPR, which covers tracking cookies that collect personal data. In practice, most failures with tracking cookies breach both laws at once, and the AP has been the more active enforcer.

What Article 11.7a of the Telecommunicatiewet requires

The core obligation under Article 11.7a is straightforward: inform first, then ask permission. A website must tell visitors what data is being stored or accessed, explain why, and obtain consent before any non-exempt cookies are set.

Two narrow exemptions exist under Article 11.7a(3). Cookies that are strictly necessary for transmitting a communication over the network do not require consent. Cookies that are strictly necessary for providing a service the user has explicitly requested, such as PHPSESSID for session management or a shopping cart cookie, are also exempt.

Analytical cookies receive a partial exemption in the Netherlands. If your analytics cookies are used solely for counting visitors and have minimal privacy impact, meaning they do not build individual profiles or share data with third parties, you may place them without consent. A properly configured, first-party instance of privacy-focused analytics can qualify, but standard _ga cookies from Google Analytics 4 generally do not, because data is shared with Google.

AP cookie banner rules: the 2025 guidance

The AP's guidance on clear cookie banners (heldere cookiebanners), updated in 2025, sets out 9 rules of thumb with examples of good banners and of what not to do. As of October 2026, it is the AP's current guidance.

First-layer information requirements

The banner's first layer, the part visible without clicking through, must clearly state what personal data is collected through cookies and whether that data is shared with third parties. A vague statement like "this site uses cookies to improve your experience" does not satisfy this requirement. The AP expects visitors to understand, at a glance, who processes their data and for what purposes.

Equal accept and reject options

If the first layer of your banner includes an "Accept all" button, it must also include a "Reject all" button at the same level. The AP had implied this before, but the 2025 guidance makes the requirement explicit. Burying the reject option behind a "Manage preferences" link does not meet it.

The AP's guidance also stresses that the site operator remains responsible for compliance even when using a third-party consent management platform (CMP). Using a CMP does not transfer legal responsibility.

The Dutch position on cookie walls

The Netherlands has taken a firm stance on cookie walls. A cookie wall, where access to a website is blocked unless the visitor accepts all cookies, does not produce valid consent in the AP's view.

The AP's position is that consent obtained through a cookie wall is not freely given, because the visitor faces a take-it-or-leave-it choice. This aligns with the EDPB's guidance on consent under GDPR Article 7, which requires that consent be as easy to refuse as to give. Some EU regulators accept limited "consent or pay" models under conditions. The AP's position concerns cookie walls that block content, and it has not set out a general rule on every paid alternative.

If your site targets Dutch visitors, the safe course is full access to content whether or not cookies are accepted.

Enforcement: fines and the 500-organisation warning programme

The AP has moved from guidance to active enforcement. On 15 April 2025, it sent letters to 50 organisations, among them online retailers, media companies and insurers, about misleading cookie banners or placing tracking cookies without valid consent. They had 3 months to fix their banners or face an investigation and a high risk of a fine.

Those were the first 50 of the 500 organisations the AP plans to warn each year. It says it constantly monitors 10,000 Dutch websites and picks out those that probably break the law with their banner.

Notable fines

The A.S. Watson case is instructive in two ways. The AP stressed that the tracking collected sensitive personal data, so the context of the cookie mattered as much as the cookie itself. And the objection decision of 12 June 2025 upheld the company's objection and cut the fine from EUR 600,000 to EUR 50,000, a reminder that the headline amount is not always the final one.

Ignoring an AP warning can lead to administrative fines of up to EUR 20 million or 4% of global annual turnover under the GDPR, whichever is higher.

How Dutch rules compare to other EU countries

The Netherlands occupies a middle ground in EU cookie enforcement: stricter than some member states, but broadly aligned with the tougher regulators. The cookie wall ban mirrors the positions of the French CNIL and the Belgian APD. The analytics exemption is more generous than France's approach, where CNIL has specific requirements for exempt analytics, but less permissive than some Eastern European regulators.

The AP's systematic monitoring programme sets the Netherlands apart. While Germany's enforcement is split across sixteen state-level DPAs and can be inconsistent, the Dutch warning programme signals sustained, predictable enforcement pressure.

For businesses operating across multiple EU markets, the Dutch rules sit comfortably within the stricter end of the spectrum. A banner that satisfies the AP's requirements will generally meet the standards in Spain, Italy and most other EU member states. The global compliance hub covers the others.

Checklist for Dutch websites

Use this checklist to verify your cookie setup meets the AP's current requirements:

• No non-exempt cookies fire before consent is obtained (check with browser developer tools or a cookie audit)

• First banner layer states what personal data is collected and whether it is shared

• "Reject all" button is visible alongside "Accept all" on the first layer

• No cookie wall blocks access to content

• Analytics cookies are either consent-gated or genuinely privacy-friendly (first-party only, no profiling, no third-party data sharing)

• Consent records are stored and can be demonstrated if the AP requests evidence

• Functional cookies such as language preferences or PHPSESSID are correctly categorised as exempt

• Third-party scripts (such as Meta Pixel or Google Ads tags) are blocked until consent is granted

• Cookie policy is written in Dutch (or the language of your audience) and references both Article 11.7a and the GDPR

• Banner design avoids dark patterns: no colour tricks, no tiny reject links, no pre-ticked boxes

Short answers on Dutch cookie rules

Check your banner before the AP's letter arrives

If you are not sure which cookies your site sets, start with a scan. Kukie.io detects and categorises the cookies it finds, shows a Dutch banner with Reject all beside Accept all and blocks tracking cookies until visitors choose.

Start free