Cookie consent in the Netherlands: Article 11.7a and the AP

What is the Dutch cookie law?

The Netherlands transposed Article 5(3) of the ePrivacy Directive in Article 11.7a of the Telecommunications Act (Telecommunicatiewet). Without prejudice to the GDPR, storing information on, or gaining access to information in, a user's terminal equipment through an electronic communications network is only allowed if the user has been given clear and complete information in line with the GDPR, at least about the purposes, and has consented. The same applies when the storage or access is achieved by other means.

Article 11.7a(3) exempts storage or access:

• with the sole purpose of carrying out communication over an electronic communications network;
• that is strictly necessary to provide the information society service the user requested;
• that serves to obtain information about the quality or effectiveness of an information society service, provided it has little or no impact on the user's privacy.

The third exemption is Dutch: few other laws write an analytics exemption into the statute. Article 11.7a(4) adds a presumption: storing or reading information to collect, combine or analyze data about a user's use of different services, so that the user can be treated differently, is presumed to be processing of personal data. In practice, tracking cookies always bring the GDPR into play. Article 11.7a(5) adds that public bodies may not make access to their online services depend on consent.

Who enforces cookie rules in the Netherlands?

Two regulators share the work. Under Article 15.1(3) of the Act, the Authority for Consumers and Markets (ACM) supervises the provisions of the Telecommunications Act that are not assigned elsewhere, which includes Article 11.7a. The Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (AP), supervises the processing of personal data through cookies under the GDPR. Since tracking cookies are presumed to process personal data, the AP has become the main cookie enforcer, and it announced that it has monitored cookie banners more strictly since 2024.

What must a cookie banner do in the Netherlands?

The AP's page on clear cookie banners lists nine general rules:

1. Explain what (types of) personal data you process and for which purposes before the visitor chooses. If you share data with third parties, say so on the first layer, with the purposes and the number of third parties per purpose.
2. Do not use pre-ticked options, on any layer.
3. Use plain words on buttons, such as "accept", "agree" or "refuse".
4. Place the buttons for refusing and accepting on the same layer. Do not offer only one of the options on the first layer.
5. Do not hide choices, for example by making visitors scroll to refuse or by giving the refuse button almost the same color as the background.
6. Do not make refusing take more clicks than accepting, for example by asking visitors to confirm their refusal.
7. Do not hide the refuse option as an inconspicuous link in the text.
8. Explain how consent can be withdrawn before the visitor chooses, and make withdrawing as easy as consenting.
9. Do not mix consent with legitimate interest: tracking cookies need consent, which legitimate interest cannot replace.

The AP also lists what is not valid consent: assuming consent when visitors keep scrolling, treating passivity as consent, pre-ticking categories at a deeper layer, and cookie walls. Visitors must be able to use a website normally without accepting tracking cookies.

Do analytics cookies need consent in the Netherlands?

Not if they are limited analytics. The AP explains that limited analytics cookies, which collect information such as the number of visitors and the most visited pages to improve the site, need no consent when they have no or little impact on privacy, as Article 11.7a(3)(b) provides. The site must still mention them in its privacy statement and, where personal data is processed, have a legal basis under the GDPR. Analytics that tracks visitors across sites, or shares data with a provider for its own purposes, falls outside the exemption and needs consent. See analytics without consent.

How much are the fines in the Netherlands?

For Article 11.7a itself, the ACM can impose a fine of up to 900,000 euros or, if higher, 1% of the company's turnover (Article 15.4(2)), and the maximum doubles if the same company was fined for a similar breach in the previous five years (Article 15.4(5)). For processing personal data through cookies without valid consent, the AP applies the GDPR, with fines up to 20 million euros or 4% of worldwide annual turnover.

The AP's best-known cookie case concerns the drugstore chain Kruidvat. On 16 July 2024 the AP announced a fine of 600,000 euros on AS Watson Health & Beauty Continental Europe for tracking visitors of Kruidvat.nl without consent: the tracking boxes in the banner were pre-ticked, refusing took many steps, and the data, such as products added to the basket and bought, could reveal sensitive information about health. On 12 June 2025, deciding on AS Watson's objection, the AP declared the objection well-founded and reduced the fine to 50,000 euros.

The AP now enforces at scale. On 15 April 2025 it announced letters to the first 50 of the 500 organizations a year it intends to warn about misleading banners. It monitors 10,000 Dutch websites, and organizations that do not fix their banner within three months face an investigation and a high risk of a fine.

How does Cookiequiet fit Dutch rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all and Accept all sit on the same first layer with the same weight by default, nothing is pre-ticked, and visitors whose browser asks for Dutch get the banner in Dutch. Every choice goes into a consent log with its date and banner version. Run the free cookie scanner to see what your site sets before consent.