Autoriteit Persoonsgegevens opens investigation into two organisations over cookie banners
The data protection authority says cookie banners must have a visible refuse button, and it has warned about 100 organisations that fell short.
The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, has opened an investigation into two organisations whose websites still use a misleading cookie banner. The AP had already explained the rules to them and warned them.
Their banners have no directly visible button to refuse tracking cookies, so visitors are more likely to accept them. The AP says refusing must be as easy as accepting, so a banner needs a visible refuse button next to the accept button.
Tracking cookies may only be placed if someone has given consent voluntarily, on the basis of clear and correct information, the AP says.
Since 2024 the AP has checked more often whether organisations ask for consent correctly before placing tracking cookies or other tracking software on visitors' devices. In recent months it has warned about 100 organisations whose banners do not meet the requirements, including in media, care and welfare, and insurance.
About 70% of the warned organisations then change their incorrect banner. Those that do not can expect an investigation and possibly a fine, the AP says.
More on digital, tech and privacy
AP (Autoriteit Persoonsgegevens)
The Dutch Data Protection Authority is the independent supervisory body that monitors compliance with privacy law in the Netherlands, including the GDPR and the rules on cookies and online tracking. It can launch investigations, issue warnings and orders, and impose fines on organisations that break these rules. People can also file complaints with it about how their personal data is handled.