Cookie consent in Belgium: Article 10/2 and the APD rules

What is the Belgian cookie law?

Belgium transposed Article 5(3) of the ePrivacy Directive first in Article 129 of the Electronic Communications Act of 13 June 2005. The Law of 21 December 2021 moved the rule, with effect from 10 January 2022, into Article 10/2 of the Law of 30 July 2018, Belgium's framework law on personal data, which refers to Article 125 of the 2005 Act. The cookie rule now sits in the data protection framework law that the Data Protection Authority applies.

Article 10/2 allows storing information on, or accessing information in, the terminal equipment of a subscriber or user only if the person receives clear and precise information about the purposes of the processing and their rights under the GDPR, and has consented after receiving it. Two cases are exempt: technical storage or access whose only purpose is to send a communication over an electronic communications network, and what is strictly necessary to provide a service the subscriber or user expressly requested.

The APD's checklist makes clear that "cookies" covers the whole family of trackers: pixels, device fingerprinting, local storage and tracking inside mobile apps.

What must a cookie banner do in Belgium?

The APD published a cookie checklist and a page on cookies and other trackers. Its main points:

• No tracker before consent. No cookie that is not strictly necessary may be placed or read before valid consent.
• Reject next to Accept. Do not offer an "accept all" button without a "reject all non-essential cookies" button on the same level. The checklist says a "Settings" button next to "Accept all" is not enough, and gives as the good example "Reject all" and "Accept all" displayed in the same way.
• No deceptive design, such as steering visitors with color.
• Specific consent. At the latest on a second layer, visitors must be able to consent purpose by purpose and, where relevant, partner by partner. Own advertising and third-party advertising are separate purposes, as are social sharing buttons and ad personalization.
• Informed consent. The first layer must state the purposes clearly, who places or reads the cookies, how to accept or refuse, the consequences of each choice, and how to withdraw consent. A lower layer lists every cookie with its purpose, lifetime and recipients.
• Active consent. No consent is inferred from continued browsing, closing the banner, inactivity, accepting terms and conditions, or browser settings. Pre-ticked boxes are excluded on every layer.
• Easy withdrawal, for example through a clearly visible link or button that lets visitors withdraw in one click, with real effect on the cookies already placed.
• Accountability. Keep earlier versions of the banner and of the cookie policy, with a date and version number.

How long can a choice be remembered?

The APD considers that a lifetime of 6 months is in principle reasonable for the cookie that stores the visitor's preferences. After that the visitor is asked again. Other cookies that are exempt from consent should expire as soon as they are no longer needed.

Are cookie walls allowed in Belgium?

No. The APD's checklist tells site owners not to use cookie walls, citing the EDPB's consent guidelines: access to a service must not depend on accepting trackers, and refusing cookies must not lead to a denial of service.

Do analytics cookies need consent in Belgium?

In principle, yes. The APD says that an analytics cookie does not in principle meet the strict necessity exemption, because it serves to send statistics to the site owner rather than to provide the service the visitor asked for. In its Roularta decision of 25 May 2022 the Litigation Chamber held that "statistical" cookies cannot generally be considered strictly necessary. Belgium has no French-style analytics exemption, so Google Analytics and similar tools wait for consent. See analytics without consent for the options that store no identifier.

What enforcement has there been in Belgium?

The APD runs cookie enforcement through its Inspection Service and its Litigation Chamber, applying Article 10/2 together with the GDPR's consent conditions:

• Roularta, 25 May 2022 (decision 85/2022): 50,000 euros. First decision of an inspection of 20 of the most visited Belgian press websites. On levif.be and knack.be, about sixty non-essential cookies were placed before consent, third-party consent boxes were pre-ticked, information was insufficient, and withdrawing consent was harder than giving it.
• Mediahuis, 6 September 2024 (decision 113/2024). On a complaint brought with noyb about De Standaard, Het Nieuwsblad, Gazet van Antwerpen and Het Belang van Limburg, the Litigation Chamber ordered a reject option on every layer where "accept all" appears and non-misleading button colors, within 45 days, with penalty payments of 25,000 euros per day per order and per website. The Market Court annulled the decision on 19 March 2025 on procedural grounds: it found that the complaint, organized by noyb through one of its trainees, was an abuse of the right to complain. The ruling did not overturn the APD's reading of what a banner must contain, which its checklist still states.

The Belgian authority also decided the case against IAB Europe over the Transparency and Consent Framework (250,000 euros, 2 February 2022), covered on the GDPR page.

Which languages should a Belgian banner use?

Belgium has three official languages: Dutch, French and German. Article 10/2 and the checklist do not name a language, but they require information that is clear, precise and concise, which a visitor only gets in a language they read. A site with visitors from several language communities therefore shows the banner and the cookie information in each of their languages.

How does Cookiequiet fit Belgian rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all and Accept all are shown the same way on the first layer by default, and the banner speaks French, Dutch or German depending on the visitor's browser. Every choice goes into a consent log with its date, banner version and language. Run the free cookie scanner to see which trackers load before consent.