Incorrect cookie banners adjusted after AP intervention
In 2024, the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, launched five investigations into cookie banners on Dutch websites. In all cases, the organisations violated the law with these websites. Following intervention by the AP, the organisations adjusted the cookie banners so their websites did comply with the law.
Since 2024, the AP has been checking more often whether organisations correctly request consent on websites to place (tracking) cookies or other tracking software. Following complaints, the AP investigated frequently visited websites in various sectors, such as the financial sector, the media and the hospitality industry.
Asking for consent
Aleid Wolfsen, chair of the AP: 'You visit a website, for example, for information or to buy something. You should be able to do that freely. If companies or other organisations want to track visitors to their website and sell their data to advertisers or data traders, for example, they must ask for your consent to do so. This must be done transparently and openly, without tricks that make it difficult for visitors to say "no". We still see too often that organisations use these types of methods. This means website visitors are tracked without their consent, and their data can be traded.'
No free choice
The five organisations that were investigated did ask consent to place cookies and other tracking software, but not in a proper manner. For example, the button to refuse cookies was hidden, or the consent option was already ticked. In some cases, the websites already placed cookies before the visitor had given consent, or even after the visitor had refused cookies.
Here's another option: don't track visitors
Organisations must always request for consent to use cookies that track visitors across websites. But a cookie banner is not always mandatory. If a website only uses strictly necessary (functional) cookies, the organisation does not need to ask for consent. For example, if an online shop only uses cookies to remember which products are in the visitor's shopping cart.
Wolfsen: 'So it's very easy: don't track your visitors, and you don't have to worry about designing a cookie banner. And your visitors won't be annoyed.'
AP general rules
For organisations that still want to use cookies or similar techniques, the AP has drawn up a number of general rules that help organisations comply with the rules.
Wolfsen: 'Smaller organisations in particular are often unaware of any wrongdoing. They receive a cookie banner from the website builder and assume that everything's okay. Unfortunately, that's often not the case. And the website owner is responsible for this, not the website builder. So always check the general rules on the AP website if you have a website built. And discuss this in advance with your website builder.'
AP to structurally check cookie banners
In the coming years, the AP will structurally check the status of cookie banners in the Netherlands. We do this by constantly and automatically scanning the cookie banners of 10,000 websites to check whether they are transparent enough. Organisations that do not comply with the law will first receive a warning and the opportunity to adjust the cookie banner. In the event of serious violations or if an organisation refuses to adjust its cookie banner, there is a good chance the AP will take enforcement action with fines or other sanctions.
