Cookie Consent in 2026: What's Changed, What's Allowed, What Has to Go?
Cookie legislation has been actively enforced since 2023. Many legacy cookie banners no longer comply. Here are the current rules and the three-column model.
The rules around cookies have tightened significantly since the enforcement wave of 2023–2024. The old "set everything to accept" banners simply don't cut it anymore.
The Three-Column Model
- Necessary cookies: no consent required. Session cookies, shopping cart, login.
- Functional cookies: essential for user experience (language preference, dark mode). Consent is often not required, as long as they genuinely don't track.
- Analytics / marketing: consent is MANDATORY. Opt-in, not opt-out. "Reject all" must be just as prominent as "Accept all".
What Cookie Banners Can No Longer Do
- Show only an "Accept" button.
- Treat scrolling as consent.
- Pre-tick marketing categories.
- Apply unlimited "legitimate interest" to tracking cookies.
- Place cookies BEFORE consent has been given.
What Must Be in the Cookie Banner
- Categories clearly explained.
- Choice per category (minimum: necessary always on, marketing/analytics separate).
- "Accept All", "Reject All", and "Manage" with equal visual prominence.
- Link to the full cookie statement.
- Option to change consent later (e.g. via a footer link).
Tools
Google Analytics 4, Meta Pixel, LinkedIn Insight — all require consent. Use Google Consent Mode V2 if you're running GA4.
Risk of Fines
The Dutch Data Protection Authority (AP) issued multiple fines for non-compliant cookie banners in 2023–2024. Typical amounts: €25,000–€100,000 for SMBs that came to their attention. This is no longer something you can afford to ignore.
See also: GDPR pillar, privacy statement.
Volledige gids: Cumplimiento GDPR para pymes: el mínimo práctico
Dit artikel is onderdeel van onze uitgebreide AVG & privacy-gids. Lees de pillar voor het complete plaatje.
Lees de pillar →