Stricter supervision of cookie rules: what your business needs to know!

Privacy Law

30 January 2025

Stricter supervision of cookie rules: what your business needs to know!

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, “AP”) has once again shown that failing to comply with cookie legislation can have major consequences. This became clear with the €40,000 fine imposed on Coolblue by the AP on 23 December 2024. Coolblue had collected data from website visitors via certain cookies without their explicit consent. This constitutes unlawful processing of personal data via cookies, and is a clear breach of the General Data Protection Regulation (GDPR).

The Coolblue case: what went wrong?

Coolblue used a cookie banner on its website (coolblue.nl) which stated that tracking cookies were used for behaviourally targeted advertisements. However, Coolblue did not ask for (explicit) consent for this. Instead, it used pre-ticked boxes, assuming that users tacitly consented to the use of the cookies. This is contrary to the General Data Protection Regulation (GDPR), which requires that consent be given explicitly and voluntarily.

The AP had already given Coolblue a warning in November 2019 in the form of a norm-transferring letter. In it, the company was informed that its cookie policy did not meet the statutory requirements. Despite this warning, Coolblue continued to breach the rules in April and May 2020.

Only in June 2020 was a new cookie banner introduced in which visitors had to actively give consent. However, that was more than six months after receiving the AP’s letter. This delay ultimately led to the fine.

Consent: a requirement, not an option

Under the GDPR, website owners must clearly inform website users about the use of cookies and give them the ability to make their own choice. Pre-ticking consent, or hiding a “decline” option, is not permitted. Coolblue’s approach of assuming consent went directly against these rules.

Stricter supervision and higher fines

The AP continues to conduct additional checks on proper compliance with the cookie rules. Misleading cookie banners, or making it difficult to decline cookies, are under particular scrutiny. The regulator has, moreover, expanded its enforcement capacity thanks to an additional budget of €500,000 per year for the years 2024–2026.

Kruidvat also fined.

Coolblue is not the only business to receive a fine. In 2024 the AP imposed a fine of €600,000 on Kruidvat’s parent company AS Watson for using tracking cookies without website visitors’ consent. The size of the fine was related to the fact that sensitive personal data was collected via the tracking cookies, and that the processing had affected a large number of people.

What does this mean for your business?

The fine imposed on Coolblue underlines that businesses must take cookie banners and cookie policy seriously. Explicitly obtaining consent for the use of tracking cookies is not a formality, but a statutory obligation under the GDPR. For consumers, this represents an important step towards more transparency and control over their online privacy, allowing them to decide for themselves which data they do or do not want to share.

To prevent your business from running into problems, it is important to:

Objectively evaluate your cookie banner and adjust it to meet GDPR requirements.
Request active consent: make sure visitors can make a conscious choice.
Implement a clear and accessible privacy and cookie policy.

Need advice on cookies?

Do you want to be sure your website complies with the GDPR and the Telecommunications Act? The corporate lawyers at The Legal Company are ready to help you with:

Developing a legally watertight cookie policy.
Advice on cookie banners that comply with the rules.
Practical solutions for processing personal data.

This article was published on 30 January 2025.

Would you like to stay informed on this topic and all other relevant business developments regarding employment law, contract law, corporate law and privacy law, and receive legal tips & tricks from our corporate lawyers? Sign up here for The Legal Alert!

Nothing changes as much as legislation and regulations. Please note that our blogs may no longer align with current legislation and regulations and may therefore be outdated. If you have questions or an issue relating to this blog, or wish to obtain legal assistance, please contact us.

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.