Cookie consent in the Netherlands: ePrivacy, the Telecommunications Act and a fair banner
7 min read · Updated 2026-11-12
Cookies and similar technologies are not governed by the GDPR alone. In the EU, Article 5(3) of the ePrivacy Directive requires consent before you store or access information on a user's device, unless an exception applies. The Netherlands implemented this in Article 11.7a of the Telecommunications Act (Telecommunicatiewet). The GDPR still governs any personal data you process after that.
When you may set a cookie without consent
Consent is not required if the storage or access is strictly necessary to provide a service requested by the user, or, in the Dutch implementation, for a communication over an electronic communications network. A sign-in cookie, a security token, a cookie that stores the user's own cookie choice, or a load-balancer cookie needed to show the page, will often fall in that class. An advertising, analytics or social-media tracking cookie does not.
If you are not sure, treat the cookie as not strictly necessary and wait for a valid choice. 'The site works better with analytics' is not an exception.
What valid consent looks like
Consent must meet the GDPR standard: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. The European Data Protection Board and the AP have been clear that a banner must present reject and accept on an equal footing. Pre-ticked boxes, a hidden reject, or 'by continuing you agree' are not valid consent.
Do not set non-essential cookies, and do not load non-essential scripts, before the person opts in. If they reject, that choice must stick. Keep evidence of the choice (what was shown, when, and what they selected).
A simple setup for a startup site
Use only strictly necessary cookies until you have a real need for something else. Publish a cookie policy that lists name, purpose, type and duration. Link it from the banner and the footer. If you later add analytics, use a privacy-friendly, preferably EU-hosted tool, load it only after opt-in, and offer a way to change the choice.
DPOne itself uses no advertising or analytics trackers. The banner on dpone.info offers accept and reject with equal weight, and optional categories stay off unless you opt in.
Frequently asked questions
Does a cookie wall meet Dutch rules?
A wall that forces tracking consent as the price of access is very hard to defend as freely given consent. The AP has warned against cookie walls that leave no genuine choice. There can be limited room for a pay-or-consent model in some EU discussions, but that is not a default path for a startup marketing site.
Are first-party analytics exempt?
Not automatically. If the cookie is not strictly necessary for a service the user asked for, you still need consent under Article 11.7a, even when the cookie is first-party.