Do you use a cookie banner for asking consent for processing the personal data of your website visitors? Do not forget that your website visitors must also be able to withdraw their consent. 

Withdrawing consent must be possible at any time. It must be just as easy as giving consent. You are not allowed to require a user to pay money for this. In addition, the withdrawal of consent should not have any negative consequences for your website visitors. 

You must give your website visitors information about how they can withdraw consent before they give it. This can be achieved by including a brief explanation in the cookie banner, with a button or a link. Make sure that there is always another way in which people can easily find the place where they can withdraw their consent. 

Does it (also) concern consent for the processing of personal data by third parties? Then you also have to inform these third parties that someone has withdrawn the consent. 

Also read the Dutch DPA's standard explanation about withdrawing consent with cookie banners (in Dutch).

Certain information should be immediately visible in your cookie banner. It must be clear as to who processes the personal data and for what purpose or purposes. This is the information that you put on the ‘first layer’ of your cookie banner. In this way, your website visitor knows what the consent is intended for. 

Other information may be placed on a second (or lower) layer. Of course, this does not change the fact that you must offer all information in a distinct manner.

Yes. The general rules for cookie banners are about cookies and all other technologies in which you store information or gain access to the user's device (such as a mobile phone or computer). 

In addition to cookies, this also concerns:

• placing non-essential data on the user's device, such as via local storage;
• tracking pixels;
• web beacons;
• fingerprinting.

First contact the owner of the website concerned. Are these cookies placed by a third party? Then you can also approach this third party. The owner of the website and the third party are both obliged to give you information.

For general information and/or complaints about cookies, you can contact the Netherlands Authority for Consumers and Markets (ACM).

Do you have a complaint about (tracking) cookies and how they are used for processing your personal data? And does the website owner not respond, or are you not satisfied with the response? Then you can submit a complaint to the Dutch Data Protection Authority.

No. You must be given the option to refuse tracking cookies. Without this having adverse consequences for you.

That is why a website is not allowed to use a cookiewall. If a cookiewall is used, you will be denied access to a website or an app if you refuse the tracking cookies. This is not permitted.

An organisation is only allowed to place tracking cookies on your device (such as your computer, laptop, smartphone or tablet) if you have been informed about this. And you have given consent for this.

The organisation that wants to place tracking cookies must provide information in advance about:

• which cookies are used;
• which personal data of you are processed;
• what happens with these data;
• how long these cookies will be retained or stay on your device.

The information about cookies must be displayed before you give or refuse consent for placing cookies. This can be done, for example, with an information bar and buttons (cookie banner) using which you can indicate whether you accept or refuse the tracking cookies.

It is not enough if the organisation merely refers to, for example, the general terms and conditions or a privacy statement.

No valid consent

In the following examples, there is no valid consent:

• Websites stating that they assume that you have given consent when you continue to use the site (continue scrolling or swiping) after an information bar has been displayed. In such case, the information bar says, for example: 'By continuing to use this website you agree to placing tracking cookies' Or: 'By clicking an article from the newsletter we assume that you give consent'.  
• Standard settings where all categories of cookies have been pre-checked. 
• Websites that you can only visit if you give consent for placing tracking cookies. Under the privacy legislation, a cookiewall is prohibited.