Skip to main content
Praxikon

Enforcement

DPA cuts Kruidvat fine to 50,000 euros on objection

Date
Status
status not established
Body
Autoriteit Persoonsgegevens
Reference
Beslissing op bezwaar AS Watson Health & Beauty Continental Europe B.V., 27 mei 2025 (kenmerk vertrouwelijk), herroept boetebesluit van 3 mei 2024; gepubliceerd 12 juni 2025
Amount
€50,000

What it is about

AS Watson, the company behind Kruidvat, objected to the 600,000 euro fine from 2024 for placing tracking cookies on kruidvat.nl without consent. The DPA upheld the objection as to the amount of the fine. It revoked the original decision, maintained that Article 6(1) read with Article 5(1)(a) GDPR was breached and set the fine at 50,000 euros. The DPA reduced the fine because of the unjustified length of its own proceedings, AS Watson's full acknowledgement of the breach, the low seriousness of the breach and a comparable fine in another cookie case. An appeal to the district court was available within six weeks.

What this means in practice

The rule is unchanged: tracking cookies that process personal data require valid consent, otherwise there is no lawful basis. The decision does show that an objection can lead to a much lower fine. That applies when the organisation fully acknowledges the breach, the DPA's proceedings took unjustifiably long and the breach is not serious. The DPA also looks at fines in comparable cookie cases.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, besluit op bezwaar AS Watson - Kruidvatchecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 14

Guidelines8 of 12

Enforcement and fines8 of 10

Legislation in motion6 of 8