Do I need a cookie banner on my website? Not always. It depends on what runs on your site, not on the size of your business. Think of a shopping basket, a statistics tool, an advertising pixel or an embedded video. If you run a website from the Netherlands, this guide explains the EU rule, the Dutch exception for low-impact analytics, what the Dutch regulator is checking right now, and what changes when you also have visitors from the UK or the US.
Everything below comes from the law and the regulators themselves: the EU's Your Europe portal, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), the UK legislation website and the California authorities. NyxWorks builds websites for small businesses in the Netherlands and sets up the technical side of cookies and analytics. This is general information, not legal advice.
Checked on 8 November 2026. Rules, enforcement and prices can change. Check the linked sources before you decide.
Do I need a cookie banner? The short answer
You need a cookie banner when your website uses cookies, or similar technology, that require consent. In practice that mostly means tracking: cookies, pixels and scripts that follow visitors, build profiles or share data with advertising platforms.
If your site only uses cookies it needs to work, and possibly statistics with little impact on privacy, you do not have to ask for consent. You do have to tell visitors which cookies you use, for example in your privacy statement.
So the honest answer to "do I need a cookie banner" is: look at your tools first. Many consent-tool vendors answer "yes" by default, but a small site without tracking can legitimately run without a banner. The Dutch regulator says so itself, as you will see below.
The EU rule in plain English
Two EU laws work together here:
- The ePrivacy rules decide when you need consent to store or read anything on a visitor's device. That covers cookies, but also similar techniques such as pixels and local storage.
- The GDPR decides how you handle the personal data you collect, and what valid consent looks like.
The EU's Your Europe portal for businesses gives the practical version. No consent is needed for cookies used only to carry a communication (such as load balancing), or cookies strictly necessary for a service the visitor asked for, such as a form, a shopping basket or a login.
Consent is needed for tracking, for example social plug-in tracking cookies used for behavioural advertising, analytics or market research, and third-party advertising cookies. So do I need a cookie banner under EU rules? Only for storage that isn't essential, such as tracking. Those cookies may not be set when the page first opens, only after consent. Visitors must get clear information per purpose and be able to consent per purpose. Withdrawing consent must be as easy as giving it. People who refuse must still get at least some service.
The Netherlands: three cookie types and one useful exception
Each EU country writes the ePrivacy rule into its own law. In the Netherlands that is article 11.7a of the Telecommunications Act (Telecommunicatiewet). It includes an exception that matters for small sites: storing or reading information is allowed without consent when it gives information about the quality or effectiveness of your website, as long as the impact on privacy is none or minor. For many small Dutch sites, this exception decides the answer to "do I need a cookie banner".
That is why the AP sorts cookies into three types:
| Cookie type | What it does | Consent needed? |
|---|---|---|
| Functional cookies | Make the site work: basket, login, language choice | No, but tell visitors |
| Limited analytical cookies | Visitor numbers and popular pages, with no or minor privacy impact | No, but tell visitors (and have a legal basis if personal data is processed) |
| Other cookies, such as tracking cookies | Follow behaviour, also across other sites, build profiles, targeted ads | Yes, beforehand |
Note the word "limited". A statistics tool only fits the middle row if the privacy impact really is minor. Once it shares data with other parties or builds profiles, it moves to the bottom row.
Do I need a cookie banner for the tools on my site?
Most business owners never "added" a cookie themselves. Cookies arrive with tools and plug-ins. These are the parts we see most often on small business websites. The last column is a rule of thumb based on the types above, not a verdict on any specific product: how a tool behaves depends on its settings.
| On your site | Usually | What to check |
|---|---|---|
| Basket, login, language choice | Functional | Is it in your privacy statement? |
| Statistics that only count, without sharing or profiles | Limited analytical | Is data shared with third parties? |
| Google Analytics or a similar tool | Depends on your settings | Advertising features or data sharing on? Then plan for consent |
| Advertising or remarketing pixel (for example from social media) | Tracking | Consent first; load the pixel only after "accept" |
| Embedded video, map or social button from another company | Often that company's cookies | Do they track? Then load only after consent |
| Third-party chat widget or form service | Varies | What does it store, and who gets it? |
Example. A yoga teacher in Utrecht has a booking button, an embedded map and a pixel for Instagram ads. The booking button is probably functional. The pixel is tracking and needs consent first. The map needs checking. So does this yoga teacher need a cookie banner? Yes, and the pixel may only load after a visitor clicks "accept".
NyxWorks follows the same rule on its own site: our Google Analytics 4 only loads after a visitor gives consent.
What the Dutch regulator is checking right now
The AP has been checking cookies more strictly since 2024 and has built a tool that quickly checks whether a cookie banner meets the rules. The approach comes in steps. First a warning letter. Serious breaches, or organisations that refuse to fix their banner, can then expect an investigation and possibly a fine.
The key moments, as reported by the AP:
- 16 July 2024: the first cookie fine, 600,000 euros for the company behind the Dutch drugstore website Kruidvat.nl, for tracking visitors without valid consent.
- April 2025: the AP starts checking structurally whether websites in the Netherlands ask for consent correctly.
- 11 November 2025: more than 200 websites have been warned; about three quarters have adjusted their banner.
- 16 October 2026: the AP opens an investigation into 2 organisations that kept a banner without a directly visible reject button after a warning. In the months before, it warned around 100 organisations, of which about 70 percent fixed their banner.
The most common problem is not a missing banner, but a banner that nudges people. Refusing must be as easy as accepting. So when you ask "do I need a cookie banner", also ask whether yours lets people refuse as easily as they accept.
Checklist: 9 rules for a compliant cookie banner
If you do need a cookie banner, the AP gives nine rules of thumb. Go through them with your own banner open next to this page.
Rules 1 to 5: information and buttons
- Explain what you collect and why, before anyone chooses. If you share data with other parties, say so in the first layer, including how many parties.
- No pre-ticked boxes or switches, not in a second layer either.
- Clear buttons such as "accept" and "reject", no vague or nudging wording.
- Accept and reject on the same layer. No extra click to reject if accepting takes one click.
- Don't hide the reject button: no scrolling to find it, no colour that disappears into the background.
Rules 6 to 9: refusing, withdrawing and legal basis
- Rejecting takes no more clicks than accepting, so no extra "are you sure?".
- No inconspicuous text link as the only way to reject.
- Withdrawing consent is as easy as giving it, for example with a button that stays on screen. Say so before the choice.
- Don't confuse consent with legitimate interest. For functional and limited analytical cookies, legitimate interest can be a legal basis, but then you must be able to show your balancing test and visitors must be able to object easily.
The AP also lists what is never valid consent: "by scrolling you agree", no action by the visitor, pre-ticked choices, and a cookie wall that blocks the site when someone refuses.
Do I need a cookie banner for UK and US visitors?
If you sell to people in the UK or the US, the answer differs per place. Whether a foreign law applies to your business depends on your situation; check that before relying on the table below.
| EU and the Netherlands | United Kingdom | California (US) | |
|---|---|---|---|
| Model | Consent first (opt-in) for non-essential cookies | Consent first, with new exceptions | Opt-out of "selling or sharing" |
| Statistics | Exempt in NL only if privacy impact is none or minor | Exempt if used only to improve your own site, not shared beyond helpers, with clear info and a simple free way to object | Not a consent question |
| Advertising tracking | Consent first | Consent first | "Do Not Sell or Share" link; honour a browser privacy signal |
| Who it applies to | Every website | Every website | Only businesses above set thresholds |
United Kingdom
The UK rule on cookies (regulation 6 of PECR) was replaced on 5 February 2026 by the Data (Use and Access) Act 2025. The new Schedule A1 keeps consent as the main route, and says consent can also be signalled through browser settings. Next to strictly necessary storage, it adds exceptions for statistics used to improve your own site or service, and for remembering preferences about how your website looks or works. Both only apply if visitors get clear information and a simple, free way to object. Advertising tracking is not on the list, so that still needs consent.
California (US)
There is no single US cookie-consent law; this guide covers California only, and other states have their own rules. California's CCPA applies to for-profit businesses doing business in California that meet at least one test: annual gross revenue above $26,625,000 (the amount since 1 January 2025, adjusted every two years), buying, selling or sharing personal information of 100,000 or more California residents or households, or earning at least half of their revenue from selling it. Covered businesses that sell or share personal information, including for cross-context behavioural advertising, need a clear "Do Not Sell or Share My Personal Information" link and must treat a browser signal such as Global Privacy Control as a valid opt-out.
One banner for every market
If your audience is mixed, one banner built to the EU opt-in standard usually covers the strictest case. That is a practical choice, not legal advice.
Do I need a cookie banner at all, or can I skip it?
You can skip it, and the AP calls this the simplest route. If you don't collect personal data with tracking cookies, you don't need consent, and the banner can go. You still have to inform visitors about the functional and limited analytical cookies you do use.
Two questions help:
- Do you actually use the data? Many organisations collect data they never use, the AP points out. That data can still travel to other parties. A pixel from an ad campaign that stopped years ago only adds risk.
- Can you do it with less? The AP names statistics services that don't follow visitors across the internet, such as Matomo, Apache Superset, Plausible Analytics and OpenPanel, provided they are set up properly. For advertising, it points to contextual ads: an ad that matches the page content instead of the person.
It is a business decision. If you actively run remarketing campaigns, you may need that pixel, and a good banner is the price. If you only want to know how many people visit, a banner mostly costs you annoyed visitors.
Test your cookie banner in 5 minutes
If your answer to "do I need a cookie banner" was yes, test the one you have. You don't need to be a developer to find the biggest mistakes. Do this on your phone and on your laptop:
- Open your site in a private window, so earlier choices don't count.
- Look at the first layer. Are "accept" and "reject" side by side, the same size and equally readable?
- Count the clicks for accepting and for rejecting. They should match.
- Reject and keep browsing. Does the site still work normally?
- Find your way back. Can you change your choice later without searching?
- Read it as a visitor. Is it clear what you agree to, and whether data goes to other parties?
To look deeper, the AP points to the free website auditing tool of the European Data Protection Board (EDPB). It shows which cookies your site sets, whether visitor data is sent on and whether your site uses a secure connection.
For a quick general check of the rest of your site (speed, SEO, basic settings), use the free Website X-ray. It does not check cookies, so use it next to the steps above.
What NyxWorks does, and what it doesn't
We set up the technical side: which scripts load only after consent, how the banner looks and works, and how you measure visits and conversions. For new websites this is part of the build. For existing sites there is Analytics & conversion setup for €99 (first-year price, regular €129), and with a care plan we check after updates that everything still works: WordPress Care €59 per month, WooCommerce Care €109 per month. Prices exclude VAT, were checked on 8 November 2026 and can change. See all prices or web development.
What we don't do: give legal advice or write your privacy and cookie policy. That stays with you or your legal adviser.
Also useful: how to start a webshop in the Netherlands, what website maintenance costs, and how to set a GDPR-friendly AI policy for ChatGPT at work.
Frequently asked questions
Do I need a cookie banner for Google Analytics?
It depends on your settings. Only statistics with no or minor privacy impact fall under the Dutch exception. With advertising features on, or data shared with other parties, plan for consent. In doubt, load the tool only after consent.
Is a cookie wall allowed in the EU?
Not in the Netherlands. The AP says people must be able to use a website normally when they refuse tracking cookies, and calls cookie walls that block refusers forbidden under the GDPR. The EU's Your Europe portal also says refusers must still get at least some service.
Do I need a cookie banner for a UK website?
Yes, for tracking and advertising. Since 5 February 2026, UK law exempts statistics used to improve your own site and storing website preferences, if visitors get clear information and a simple, free way to object.
Do I need a cookie banner for US visitors?
Not under a single US law. California's CCPA works with an opt-out ("Do Not Sell or Share") and only applies to businesses above its thresholds. Other states have their own rules. If you also serve EU visitors, EU rules apply to them anyway.
Not sure about your own site?
Still asking yourself "do I need a cookie banner"? Not sure which tools on your website set cookies, or how to load them only after consent? In a 30-minute consultation (€30, checked on 8 November 2026, can change) we go through your site together and tell you what is needed technically. The legal part stays with you or your adviser.
Sources
- Your Europe: Online privacy for businesses (European Union)
- Dutch Data Protection Authority: Cookies
- Dutch Data Protection Authority: Clear cookie banners
- Dutch Data Protection Authority: Cookies and your organisation
- Dutch Data Protection Authority: How the AP monitors cookies
- AP: three quarters of websites adjusted their cookie banner (11 November 2025)
- AP: investigation into misleading cookie banners (16 October 2026, in Dutch)
- AP: 600,000 euro fine for tracking cookies on Kruidvat.nl (16 July 2024, in Dutch)
- Dutch Telecommunications Act, article 11.7a (in Dutch)
- UK: PECR regulation 6
- UK: PECR Schedule A1
- California Attorney General: CCPA
- California Privacy Protection Agency: updated monetary thresholds
- EDPB Website Auditing Tool
Checked on 8 November 2026. Rules, enforcement and prices can change. This is general information, not legal advice.
Next step
Want this done for your business?
Tell us what you need. You get a fixed scope and a public price, usually within a day.
Start a project
