Cookie banner GDPR rules: what's allowed and what's not

What are cookies and why are there rules?

A cookie is a small file a website stores on the visitor's device. It lets the site remember, for example, what's in your shopping basket. But cookies can also be used to follow someone across different websites and build a profile for advertising.

That last part touches on privacy. That's why the rules don't only apply to actual cookies, but also to similar techniques, such as social media pixels and other scripts that collect data about visitors.

There's also a difference between cookies from your own site and cookies from other parties. The latter are placed by, for example, an ad network or social media platform. Those are exactly the parties that can follow visitors across many websites. That's why regulators look at them extra critically.

Which cookies need consent?

It helps to split cookies into three groups:

• Functional cookies: needed to make the site work, such as a shopping basket, a language choice or remembering your cookie choice. No consent is needed for these.
• Analytics cookies: to measure how your site is used. If they have little or no impact on privacy, for example because data isn't shared and IP addresses are shortened, consent is often not needed in the Netherlands. If the tracking goes further, it is.
• Tracking cookies: to follow visitors for ads or profiles, such as ad pixels and social media plug-ins. You always need consent in advance for these.

If you use Google Analytics, check carefully how it's set up. You can read how to measure without collecting unnecessary data in Google Analytics 4 explained.

What must a cookie banner comply with?

Consent is only valid if it's given freely, specifically, on an informed basis and unambiguously. For a banner, that means in practice:

• No pre-ticked boxes. Visitors must actively choose for themselves.
• Refusing is as easy as accepting. A 'Reject' button next to 'Accept', equally large and equally clear.
• A clear explanation in plain language: which cookies, what for and from which parties.
• No tracking before consent. Scripts may only load after a yes.
• Withdrawing consent must be as easy as giving it, for example via a link at the bottom of every page.
• You must be able to show that someone gave consent. A good cookie tool records this.

Pay attention to the design of the banner itself too. It shouldn't cover the whole page on a phone, it must work with a keyboard and it must be easy to read. A banner that sits calmly at the bottom or in the middle, with short text and two clear buttons, is the most pleasant for visitors. Anyone who wants to know more can click through to the settings per category.

Cookie walls and other common mistakes

A cookie wall blocks your site until the visitor accepts tracking cookies. According to the Dutch Data Protection Authority, that's not allowed, because the consent is then not freely given. Other mistakes you often see:

• Only an 'Agree' button and a hidden 'Settings' link.
• A brightly coloured accept button next to a small grey reject button.
• Text such as 'By continuing to browse you agree'. Clicking on is not consent.
• Pixels and analytics that already load before the visitor has chosen anything.
• A banner that reappears on every page, even after a choice has been made.
• A cookie list that hasn't been updated for years, while new tools have been added.

Cookie banner and GDPR: what else does your site need?

The banner doesn't stand on its own. You also need a cookie statement, listing the cookies, their purpose, how long they're kept and the parties that place them. On top of that, your site needs a privacy statement that explains which personal data you process and what rights visitors have. You can read how to put one together in a privacy statement for your website.

If you use Google Ads, Google asks advertisers in the EU to pass on consent signals. This is called Consent Mode. A good cookie tool handles that, so your ads and tracking keep working within the rules.

Embedded content counts too. A YouTube video, a Google Maps map or a chat widget from an external party can place cookies as soon as the page loads. Only let such elements load after consent, or first show a simple placeholder with a button to load the content. That keeps your page within the rules and often makes it faster too.

How to tackle it step by step

• List every tool on your site: analytics, ad pixels, chat, video, maps, forms.
• Put each tool in a group: functional, analytics or tracking.
• Choose a cookie tool that genuinely blocks scripts until there's consent.
• Make sure the banner has equal buttons for accepting and rejecting.
• Write or update your cookie statement and privacy statement.
• Test in a private window: do scripts load before you choose anything?
• Check again whenever you add a new tool or marketing campaign.

That last step is often forgotten. Include it in your regular website maintenance.

How we handle this on a new website

On the websites Violexa builds, the cookie banner is part of the build. We make sure scripts only load after consent and that the buttons are fair. The legal wording of your statements remains your responsibility. Have it checked by a lawyer if needed.

A custom website starts from €1,799 excl. VAT (€2,177 incl. VAT) per project, with design, development, a layout that works on every screen, basic SEO, Google Analytics, CMS integration and training. Read more under websites and apps.

Want to know whether your current cookie banner is right? Book the free quickscan: 30 minutes, online or on site. Afterwards you get brief written advice with a price indication.

Frequently asked questions