Skip to content
Emir Hoca.

Dutch cookie banner enforcement: is your reject button on the first screen?

The Dutch data protection authority opened investigations into cookie banners that hide the reject button. A check you can run on your own site.

2 min read

On 16 October 2026 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) announced investigations into two organisations that kept using misleading cookie banners (AP, 16 October 2026). If your site serves visitors in the Netherlands, I suggest checking your cookie banner this week. You can do most of the check yourself.

What did the AP say?

The banners under investigation had no directly visible button for rejecting tracking cookies. According to the AP, rejecting tracking cookies should be as easy as accepting them, with a visible reject button next to the accept button.

The AP also said it had warned about 100 organisations about non-compliant banners in recent months, and that roughly 70 percent of them fixed the banner. The basic rule hasn't changed: tracking cookies may only be placed after the user has freely given consent based on clear and accurate information.

To be precise about one thing: this announcement is the start of an investigation. There is no ruling or fine yet. It concerns enforcement in the Netherlands, and the situation in Belgium and Turkey needs to be assessed separately. This post is a technical checklist and is not legal advice.

An off-the-shelf cookie tool may not be enough

Most sites use a ready-made template from a consent management platform (CMP). If the template's default puts the reject option on a second screen or behind a small "settings" link, you end up in the situation the AP describes, whichever tool you use. So look at how the banner actually appears on your site instead of relying on the tool's name.

Even if the banner looks right, the technical side is a separate question. If Analytics, ad and pixel scripts still load after someone clicks "Reject", the banner only looks compliant.

Checklist

  1. Put "Accept" and "Reject" on the first banner layer with the same visibility.
  2. Confirm that rejecting takes no more clicks, scrolling or extra confirmation than accepting.
  3. In a clean browser session, click "Reject" and check in the Network tab of the developer tools that Analytics, ad and pixel requests are actually blocked.
  4. Remove pre-ticked options and describe the purposes in clear, separate categories.
  5. Make sure users can withdraw consent as easily as they gave it.

The third step is the one people skip most. Opening the site in a private window, clicking reject, reloading and listing the outgoing requests takes a few minutes.

Running the reject test step by step

Open a private window in Chrome or Firefox, open the developer tools and switch to the Network tab. Load the site, click "Reject" when the banner appears, then reload the page. In the Network filter box, type google-analytics, googletagmanager, facebook and the names of any other ad tools you use, one at a time. If requests still go to these addresses after rejecting, the setting behind the banner isn't working.

Run the same test once with "Accept". If requests go out after accepting and not after rejecting, the banner does its job. If you see the same requests in both cases, check how the cookie tool is connected to your tag manager.

If you're not sure what your banner really blocks after a rejection, we can look at it together.

Sources

Dutch cookie banner enforcement: the reject button — Emir Hoca