Dutch DPA investigation puts deceptive cookie banners under scrutiny, reinforcing that rejecting tracking must be as easy and visible as accepting it.
The Dutch Data Protection Authority (AP) has opened investigations into two organisations that continued using misleading cookie banners after receiving guidance and a warning. Their websites displayed no immediately visible button for refusing tracking software, making visitors more likely to accept tracking cookies.
The investigations signal a move from supervisory guidance to formal scrutiny where organisations do not correct defective consent interfaces. Since 2024, the AP has increased its monitoring of how websites request consent for tracking cookies and comparable technologies. It says that around 100 organisations have recently been warned across sectors including media, health and welfare, and insurance. Around 70 per cent amended their banners after intervention, while those that do not may face an investigation and potentially a fine.
The investigation focuses on whether refusal is as easy as acceptance.
The immediate issue is simple but important: a visitor should not have to search for, scroll to or open an additional layer to refuse tracking when accepting it requires only one visible action. The AP says that a cookie banner should place a directly visible refusal button alongside the acceptance option.
This is not merely a design preference. Consent must represent a genuinely free, informed and unambiguous choice. An interface that prominently encourages acceptance while making refusal less accessible can steer behaviour and undermine the validity of the resulting consent.
Consent-banner design is part of the legal control environment.
Organisations sometimes treat the cookie banner as a technical component delegated to a marketing team, web agency or consent management platform. The AP’s approach shows why it should instead be governed as part of the organisation’s privacy control environment. The controller remains responsible for the choices presented, the information supplied and the technologies that activate after each choice.
A compliant configuration therefore requires more than inserting standard text. The banner, consent platform, tag manager and website scripts must work together so that non-essential tracking does not begin before consent, a refusal is respected and a later withdrawal changes the underlying data flows.
Clear choices require more than adding a reject button.
The AP’s guidance on clear and misleading cookie banners identifies a broader set of practices that can compromise consent. Options should not be pre-selected, button labels should be clear and choices to accept or refuse should appear on the same layer. The refusal option should not be hidden in body text, made difficult to read or require additional clicks.
The information shown before a choice should explain that personal data are being processed, identify the controller and describe the purposes. Where data is shared with third parties, the banner should give meaningful information about that sharing. Organisations should also explain how consent can be withdrawn before the visitor decides and keep the withdrawal mechanism readily accessible afterwards.
Tracking practices should be reviewed before the interface is redesigned.
A banner review should begin with an accurate picture of the website’s technologies rather than with the wording alone. Organisations need to know which cookies, pixels, local-storage tools, software development kits and fingerprinting techniques operate on each page, what information they collect and which parties receive it.
That mapping allows essential, limited analytical and tracking technologies to be classified correctly. It also helps prevent consent from being confused with another lawful basis. The AP specifically warns organisations not to present legitimate interest as though it were a consent choice and notes that personalised advertising cannot simply be justified on that basis.
Third-party tools do not transfer accountability away from the website operator.
Consent management platforms can help scan websites, block technologies before consent and communicate user choices. However, default settings and vendor templates may not reflect the organisation’s actual processing or the AP’s expectations. Changes to analytics, advertising or embedded content can also introduce new trackers without a corresponding update to the banner.
Contracts should therefore be supported by technical testing. Website owners should verify what loads before a choice, after acceptance, after refusal and after withdrawal. They should also confirm that consent signals reach every relevant recipient and that evidence of the visitor’s choice is retained only as necessary.
DPOs should test the complete consent journey in practice.
For DPOs, the announcement provides a practical reason to include cookie governance in routine monitoring. Testing should cover desktop and mobile versions, common browsers, different language settings and pages where third-party content is embedded. The number, prominence and wording of clicks should be compared for acceptance and refusal rather than assessed in isolation.
The review should also examine whether withdrawal is as easy as giving consent, whether a refusal persists and whether the organisation can demonstrate what information and choices were presented at the relevant time. Screenshots, configuration records, scan results and change logs can provide useful evidence, but they should reflect the live user experience.
The enforcement pattern rewards prompt remediation but raises the cost of delay.
The AP’s figures show that supervisory warnings are producing changes across the market. They also show that a warning should not be treated as informal correspondence that can remain unresolved. The two investigations concern organisations that continued using a misleading design despite having received both an explanation and a warning.
Businesses should respond to regulatory contact with a documented remediation process: preserve the original configuration, identify the affected processing, suspend questionable tracking where necessary, implement and test the correction, and provide clear evidence of completion. The same discipline is useful before any regulator becomes involved.
Discover how Aphaia helps organisations build transparent consent governance.
Aphaia helps organisations assess cookie and tracking technologies, review consent interfaces, map third-party data flows and translate regulatory expectations into workable controls. Independent testing and clear accountability can help ensure that the experience presented to website visitors matches the organisation’s privacy documentation and technical configuration.
