Misleading cookie banners: what the Dutch DPA's October investigation means for your municipality's website

Imagine you are the data protection officer (DPO) of a Dutch municipality. A resident emails a screenshot of the municipal website. At the top is a banner with a large blue "Agree" button and a grey "Settings" text link. Anyone who wants to watch a video on the waste collection page is told that it only works after accepting "all cookies". The resident asks: is that allowed?

Since 16 October 2026 that question has become sharper. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) then announced that it had opened an investigation into two organisations that kept using a misleading cookie banner despite an explanation and a warning.

What the AP did

The investigation concerns two organisations whose cookie banner has no directly visible button to reject tracking cookies. As a result, visitors are more likely to accept. The AP writes that since 2024 it has checked more often whether organisations ask for consent to cookies and other tracking software in the right way. In recent months it warned about 100 organisations, including in the media, health and welfare, and insurance sectors. Most of them, about 70 percent, then adjusted their banner.

It is not the first round. On 11 November 2025 the AP reported that more than 200 websites had received a warning and that about three quarters had adjusted their banner. And in July 2024 the AP fined the company behind the Kruidvat drugstore chain 600,000 euros for tracking cookies without valid consent. Municipalities are not mentioned in these announcements, but the rules apply to their websites just the same.

Lesson 1: two laws, one banner

Two sets of rules apply to cookies side by side. Storing or reading information on a visitor's device is only allowed after clear information and consent (Article 11.7a(1) of the Telecommunications Act). That does not apply to cookies strictly necessary to provide the service the visitor requested, or to measuring the quality or effectiveness of the site where that has no or minor consequences for privacy (paragraph 3). If you process personal data with cookies, the GDPR applies as well.

The consent must meet the GDPR standard: freely given, specific, informed and unambiguous. A pre-ticked box is not valid consent, the Court of Justice held in Planet49 (C-673/17, 1 October 2019). According to the same judgment, visitors must also be told how long cookies operate and whether third parties can access them. Tracking that combines use across different services so that someone can be treated differently is presumed by law to involve processing of personal data; that presumption is rebuttable (Article 11.7a(4)).

Lesson 2: rejecting must be as easy as accepting

In its rules of thumb for clear cookie banners the AP lists what is not allowed:

• making the accept button more prominent than the reject button, for example larger or more colourful;
• hiding the reject button behind extra clicks, scrolling or a text link;
• pre-ticking boxes or switches, also in a second layer;
• asking for extra confirmation when rejecting;
• offering only "accept all" without an equivalent "reject all" button on the same layer;
• vague buttons such as "OK" or "Got it".

The banner in the example, with a blue "Agree" button and a grey "Settings" link, does not meet that standard. According to the AP you may also not process personal data with cookies that require consent before the visitor has made a choice.

Lesson 3: a municipality may not use a cookie wall

For public bodies the law contains an additional rule. Access to an information society service provided by or on behalf of a legal person established under public law may not be made conditional on consent to cookies (Article 11.7a(5) of the Telecommunications Act). A municipality is such a legal person.

A municipality therefore cannot put a cookie wall in front of its website or its digital service desk. A visitor who rejects cookies must be able to read the information on waste collection and apply for a permit just as well. The video on the waste collection page is also part of the information the municipality provides. Making it conditional on consent sits uneasily with paragraph 5. Consent to "all cookies" as a condition for a single video is, moreover, not specific (Article 4(11) and Article 7(4) GDPR). We know of no rulings or AP guidance on exactly this situation. The safest route is a version without tracking cookies, or a plain link to the video, and a page that otherwise works without consent.

Lesson 4: legitimate interests are not your legal basis

According to the AP, you do not need consent for functional and limited analytical cookies. That follows from Article 11.7a(3) of the Telecommunications Act, and the exemption applies to a municipality too. You must inform visitors and make objecting easy. For the GDPR legal basis, the AP writes that you base that processing on legitimate interests. For a business that is correct. A public authority, however, cannot rely on legitimate interests when performing its tasks (Article 6(1), last subparagraph, GDPR).

A municipality must therefore substantiate that the measurement is necessary for a task laid down by law (Article 6(1)(e) and 6(3)). If it cannot, it measures without personal data or asks for consent. The AP's rules of thumb do not address this. The right to object also applies under that legal basis (Article 21 GDPR). The objection must then relate to the visitor's particular situation; a municipality may choose to honour every objection. The AP's lesson stands: make clear to visitors how they can object, and keep that separate from giving or refusing consent.

Lesson 5: embedded videos and buttons are yours too

A video, a map or a social media share button on your site may place third-party cookies or send data to that third party. The Fashion ID judgment (C-40/17, 29 July 2019) concerned a Facebook button on an online shop. According to the Court of Justice, whoever embeds such a button is a joint controller with the provider for the collection and transmission of the data. What the provider does with the data afterwards is not covered. The judgment was given under the old data protection directive, but is followed under the GDPR (Article 26) and applies by analogy to videos and maps. Because the data were transmitted as soon as the page loaded: load third-party content only after consent.

If you share data with third parties for a purpose, the AP says you must make that clear straight away in the first layer of the banner, with the number of parties or their names. In the second layer or the cookie policy you set out which categories you share, for which purposes and with which parties.

Lesson 6: withdrawing must be as easy as giving consent

Visitors must be able to change their choice easily later. According to the AP you say so on the first screen of the banner, before the visitor makes a choice. Make withdrawal accessible outside the banner too, for example with a fixed button on screen. Visitors should not have to search for it.

Lesson 7: and the chatbot on the site?

More and more municipalities put a chatbot on their website. If the chat widget stores cookies or other information on the device, Article 11.7a of the Telecommunications Act applies to that too. In addition, the AI Act has applied since 2 August 2026: an AI system intended to interact directly with people must be designed so that they are told they are dealing with AI, unless that is already obvious to a reasonably observant visitor (Article 50(1) AI Act). The notice must come at the latest at the first interaction (paragraph 5). That duty lies with the provider. If the municipality has the chatbot developed and puts it into service under its own name, it may itself be the provider. So check in any case that the notice is there.

Residents often type personal data into such a chat, sometimes sensitive data. Agree in the processing agreement that the supplier does not use chat conversations for its own purposes, such as training its model. And as a deployer, take measures under Article 4 AI Act to support the AI literacy of the staff who manage or use the chatbot; you do not have to guarantee a particular level.

For a bank and a school

A bank, as a business, can rely on legitimate interests for functional and limited analytical cookies. For personalised advertising, the AP says that is not a valid legal basis. If a bank tracks visitors for marketing, consent is required, with a reject button as visible as the accept button. For businesses too, refusing must be free; paragraph 5 makes the ban on a cookie wall explicit for public bodies. The Kruidvat fine shows that the AP also acts against big brands.

A school sometimes falls under a legal person established under public law. If the competent authority of a public school is the municipality or a public legal person (Article 47 of the Primary Education Act), Article 11.7a(5) also applies to the school's website. For a foundation, as with denominational schools, paragraph 5 does not apply unless the site is provided on behalf of the municipality. Children and parents visit the site and the learning environment often, and are less able to recognise a misleading banner. Use as few tracking cookies as possible there.

What to do now

1. Look at the banner on your municipal website and digital service desk on a phone and a laptop.
2. Check that reject and accept are on the same layer, equally large and equally visible.
3. Make sure no page and no form depends on consent to cookies.
4. Record the legal basis per cookie; do not use legitimate interests for your tasks.
5. List embedded third-party services, and replace them where possible with versions without tracking cookies or with a link.
6. Put a fixed button on screen for changing the choice.
7. For the chatbot, check the notice that it is AI, and what the supplier does with the conversations.

Want to check which obligations apply to your own processing under the GDPR and the AI Act? Use the free case check. Decisions and guidelines on the GDPR are collected under GDPR guidelines.

What remains open

• The outcome of the investigation. The AP does not name the two organisations and has not yet said whether a fine will follow.
• The legal basis for public bodies' analytical cookies. The AP's rules of thumb assume legitimate interests; for public bodies they do not work out which legal basis applies instead.
• The European cookie rules. The Digital Omnibus proposal (COM(2025) 837) would bring cookies involving personal data under a new Article 88a GDPR, with one-click refusal. The Council Presidency compromise of June 2026 deleted that article and regulated cookies through the ePrivacy Directive. On 21 October 2026 the Council adopted a negotiating mandate; Parliament has no position yet. No text has been adopted; the current rules apply today.