Cookie consent in Denmark: what the cookie order requires

Which Danish rule regulates cookies?

Denmark transposes Article 5(3) of the ePrivacy Directive in an executive order rather than a statute: Bekendtgørelse nr. 1148 af 9. december 2011 om krav til information og samtykke ved lagring af eller adgang til oplysninger i slutbrugeres terminaludstyr, known as the cookie order (cookiebekendtgørelsen). It was issued under the Act on Electronic Communications Networks and Services and has applied since 14 December 2011.

Section 3(1) is the core rule. Natural or legal persons may not store information, or gain access to information already stored, in an end user's terminal equipment, or let a third party do so, unless the end user consents after receiving adequate information. Section 3(2) defines adequate information. At a minimum it must:

1. be written in clear, precise and easily understandable language;
2. state the purpose of the storage or access;
3. identify every natural or legal person behind the storage or access;
4. give the user immediate access to refuse or withdraw consent, with clear instructions on how to use it;
5. be given to the user directly, collected in one place and clearly.

Where storage happens through a website or app, the information must also stay permanently available through a direct and clearly marked link on that service.

The order defines consent as a voluntary, specific and informed indication of wishes. The joint guidance applies the stricter GDPR standard, which also requires an unambiguous, active choice.

Which cookies are exempt?

Section 4 has the two exemptions of the Directive: storage or access whose sole purpose is to transmit a communication over a network, and storage or access required for the provider to deliver an information society service the user explicitly asked for. Section 4(2) adds that storage is required when it is a technical precondition for delivering the service in line with its purpose.

The May 2025 guidance gives examples of technically necessary technologies: login and user validation, shopping carts, settings the user actively chose such as language or font size, authentication on restricted services and load balancing. It also covers third-party fonts, but only when the third party uses the data solely to deliver the fonts and not to track users across sites.

Do analytics cookies need consent in Denmark?

Yes. The guidance states plainly that you must obtain consent if you use cookies and similar technologies to generate visitor statistics or show personalized ads. There is no analytics exemption in Danish law. The order applies whatever information is collected, so even statistics that are not personal data need consent if they rely on storing or reading something on the device.

What must a Danish cookie banner do?

The joint guidance of Digitaliseringsstyrelsen and Datatilsynet describes the banner in detail:

• Refusing as easy as accepting. Users must be able to decline, and it must be as easy to refrain from consenting as to consent. A banner with only an accept button is invalid.
• No nudging. The guidance shows a green OK button next to a pale Reject as an example of unlawful nudging: refusing must appear as clearly as accepting. Showing the banner again on every visit is also pressure.
• Granular purposes. Users must be able to consent per purpose, and vague labels such as "third-party technologies" are not specific enough.
• First-layer information. The first layer must at least name the organization and its partners, the purposes, the types of data, whether data goes to third parties and the right to withdraw consent. Cookie names, providers and expiry dates can sit on a second layer.
• Easy withdrawal. For example a clear link at the top or bottom of every page, or a fixed icon that reopens the choices.
• Renewal. It will often be appropriate to renew consent once a year, and to ask again a user who refused once a year.
• Documentation. You must be able to document your consent procedure, for example with screenshots of each version of the banner.

Cookie walls are not banned outright. They can be acceptable when users get a reasonable alternative, such as access for a reasonable price, and Datatilsynet has set four criteria for that alternative. A wall with no alternative does not produce voluntary consent.

Who enforces the cookie rules in Denmark?

Two authorities share the work. Digitaliseringsstyrelsen, the Agency for Digital Government, supervises the cookie order. Datatilsynet, the Danish data protection authority, supervises the GDPR and the Danish Data Protection Act when cookies process personal data.

The most visible case so far came on 6 November 2023, when Digitaliseringsstyrelsen announced orders against Meta Platforms for da-dk.facebook.com and against Google for google.dk. The agency found that their cookie solutions breached the order and gave both companies four weeks to let users consent per main purpose, give users immediate, persistent and clearly marked access to withdraw consent, and provide persistent information about all cookies used in clear language.

How high are the fines in Denmark?

Section 5 of the cookie order punishes breaches of section 3 with a fine (bøde), and companies can be held criminally liable. It is a criminal fine imposed by the courts, not an administrative penalty, and the order sets no maximum. Denmark also has no administrative GDPR fines: Datatilsynet reports a case to the police and the courts set the fine, within the GDPR ceiling of 20 million euros or 4% of worldwide annual turnover. We found no court fine under the cookie order as of October 2026.

Does the banner have to be in Danish?

The guidance says you should, as far as possible, write the consent solution in the same language as the rest of your service, so a Danish-language site should have its banner and privacy policy in Danish. It also asks for plain language without unnecessary technical or legal terms.

How Cookiequiet fits

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Danish to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting is included on every plan, including Free. The cookie scanner lists what your site sets, which the guidance recommends checking each time you add a feature, and the Reject all guide covers the button design.