Cookies on your website
If your website or app uses cookies, you must inform your visitors. In many cases you also need your visitors' explicit consent to set cookies.
What are cookies?
A cookie is a file that saves internet settings on your website visitors' computer, smartphone, or tablet. Cookies enable you to collect and store information about your website visitors. For example, you can use cookies to improve the performance of your website, or to follow the online behaviour of your visitors, and/or provide targeted adverts to them.
There are different types of cookies:
- Functional cookies: to make your website function properly, such as recording the contents of a shopping cart.
- Analytical cookies: for collecting anonymous information about the use of your website, for example by counting the number of visitors to a page. The information is used only to improve your website's quality and functionality.
- Other cookies, such as tracking cookies. Tracking cookies collect information about your visitor's internet behaviour and their interests, to enable you to tailor your advertisements accordingly.
For which cookies do you need explicit consent?
You must always ask your visitors' explicit consent to set cookies that collect sensitive personal data, such as tracking cookies. You may only use these cookies if your visitor has given their consent. If you use this type of cookies, you process personal data and thus you have to keep to the privacy rules (GDPR).
No consent needed
You do not need your visitors' consent to set cookies if you do not store any sensitive personal data, such as functional cookies and analytical cookies with no or little impact on your visitors’ privacy.
You must still inform your visitors that you use cookies. You can do this, for example, in your privacy statement on your website or app.
Cookie notification or cookie declaration
Do you use cookies on your website? Then you must tell the user clearly and comprehensively which cookies you use on your website, why you use them, and what you do with the collected data. You can do this via a cookie notification or cookie declaration (cookie banner). Make sure visitors can clearly choose which cookies they agree to. You must also let your visitors know how they can easily object to cookies.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) monitors whether your cookie notification complies with the rules.
How to ask permission to use cookies?
If you want to place cookies on your website, you need to ask permission first (consent). You can do this with a cookie notification. You must mention the following, among other things:
- which information you want to collect
- why you want to collect the information
- how long you intend to store the information
- with which companies you share this information
- how your visitors can withdraw their consent
Your visitors must give their consent actively. They must have a clearly visible choice to accept or refuse cookies. You must also be able to show proof of your visitors' consent.
What does not count as consent for cookies?
Consent is not valid if:
- the website visitor does not have to actively give consent (if someone does nothing, they do not automatically consent)
- the user continues to use your website after an information banner has displayed, such as ‘If you visit this website you agree automatically to the use of cookies’
- you use pre-checked boxes
- you use a cookie wall that prevents visitors from entering your website or using it normally if they refuse the cookies
Withdrawing consent
You must make sure visitors to your website can withdraw their consent just easily as they have given it. If they withdraw their consent, you must still offer them access to your website.