Cookie law in the Netherlands: what does your website need?

You have probably clicked away a cookie banner more than once without thinking twice. But if you run a website yourself, you are also legally required to inform your visitors about cookies. Cookie law is not just for big corporations. It applies to freelancers and small business owners too.

What does the law actually say?

In the Netherlands, cookie rules fall under the Telecommunications Act and work alongside the GDPR. The short version: if your website places cookies, you need to inform your visitors about it, and in some cases you need their permission before placing any cookies at all.

Not all cookies are treated the same way.

• Functional cookies are needed for your website to work properly, such as a shopping cart or login session. No consent is required for these.
• Analytical cookies, like those from Google Analytics, sit in a grey area. If you configure them with privacy-friendly settings and do not share personal data with third parties, you can place them without prior consent. You do still need to mention them in your privacy policy.
• Tracking and marketing cookies from tools like Google Ads or the Meta Pixel always require explicit consent from the visitor before they are placed.

What does your website need?

A cookie banner

If you use tracking or marketing cookies, you need a cookie banner that lets visitors make an active choice. Consent cannot be pre-ticked, and simply scrolling or clicking away cannot count as agreement. Visitors need to be able to say no just as easily as they can say yes.

A cookie statement

Your website needs to clearly explain which cookies you use, what you use them for and how long they are stored. This can be a separate cookie page or included in your privacy policy. Also mention any third parties that place cookies through your site, such as Google or Meta.

A privacy policy

This is required as soon as you process personal data, which is almost always the case if you have a contact form, newsletter or analytics set up. Your privacy policy should explain what data you collect, why you collect it and what rights your visitors have.

Common mistakes

One thing I come across regularly on small business websites is a cookie banner that looks fine on the surface, but tracking scripts are already loading before the visitor has made any choice. That is not allowed. Tools like Google Ads or the Meta Pixel may only become active after the visitor has given consent.

Another common mistake is a cookie statement that no longer matches what is actually happening on the website. Whenever you make changes to your site, make sure your cookie statement stays up to date as well.

Getting it sorted

For most small websites, this does not have to be complicated. A reliable cookie management tool, a clear cookie page and an up-to-date privacy policy will take you a long way. If you are unsure what exactly applies to your situation, it is worth speaking to a lawyer who specialises in privacy law. For the technical side of things on your website, I am happy to help you get it right.