Knowledge
Cookie consent in the Netherlands.
The cookie banner is the most-seen piece of legal design on the Dutch web — and most versions are both annoying and wrong. The actual rules are simpler than the banners suggest.
Updated 26 July 2026
The short answer
Dutch law (the Telecommunicatiewet, alongside the AVG) splits cookies in two: purely functional cookies — shopping carts, login sessions, language choice — may run freely, while tracking and marketing cookies require freely given consent before they load. Privacy-friendly configured analytics sits in a tolerated middle lane with minimal fuss. A compliant banner therefore offers a real choice, with “accept” and “decline” equally easy, loads tracking only after a yes, and lets visitors change their mind later. Sites that track less need to ask less — the most elegant compliance of all.
The two-lane system in practice
Lane one, consent-free: everything technically necessary for the service the visitor requested. Lane two, consent-first: advertising pixels, cross-site tracking, marketing tags, embedded media that profiles viewers — all of it waits until the visitor agrees. The classic violations are loading trackers before the click, pre-ticked boxes, and banners where refusing takes three screens while accepting takes one. The regulators (AP and ACM) have both lanes in view, and dark-pattern banners draw their attention first.
Designing consent people respect
Compliance and conversion point the same way: track only what you use, prefer privacy-friendly analytics that keeps the banner small, write the banner in plain words, and make both buttons honest equals. A business site that skips third-party trackers can shrink the whole question to a modest notice — faster pages, calmer visitors, zero consent debt. The banner is a brand moment: it is the first interface many visitors touch.
Frequently asked questions
Do I need a banner if I only use functional cookies?
A consent banner exists for tracking, so a purely functional site can do with a brief mention in the privacy statement. The moment analytics or marketing tags join, the consent question joins with them — sized to what you actually load.
Is Google Analytics allowed in the Netherlands?
Configured privacy-friendly — IP anonymisation, data-sharing limited, a processor agreement in place — analytics has a workable, documented route here. Privacy-first alternatives simplify life further; heavier marketing use of the data moves it firmly into consent territory.
What does a compliant banner look like?
Two equal buttons (accept and decline), plain language about purposes, a settings option for granularity, zero pre-ticked boxes, trackers loading only after consent, and a way to revisit the choice — typically a small footer link. Everything else is decoration.
Further reading
Free advice
Shall Ovolum take a look at your website?
Ask your question — you will receive a personal, written answer within one working day. Free of charge, with full attention.