Can a website place cookies without my consent?

Websites may only place functional cookies without your consent. For all other cookies such as tracking, marketing, or analytics cookies, they need your explicit consent. This right to control your personal data is enshrined in the General Data Protection Regulation (GDPR) and the Dutch Telecommunications Act.

Let MijnRecht.AI analyze your situation for free

Analyse my situation

The short answer

No, websites cannot just place all cookies without your consent. They may only use strictly necessary cookies that are essential for the functioning of the website, such as cookies for login or shopping cart functionality. For tracking cookies, marketing cookies, social media cookies and analytics cookies, they must first ask for your explicit consent through a cookie banner. You always have the right to refuse this consent or withdraw it later.

What does the law say?

The General Data Protection Regulation (GDPR) and the Dutch Telecommunications Act set clear rules for the use of cookies. Websites may only place cookies if they have a valid legal basis. For non-essential cookies, consent is the only permitted legal basis, and this consent must be freely given, specific, informed and unambiguous.

1GDPR Article 6: requires a lawful basis for processing personal data

2Telecommunications Act Article 11.7a: prohibits storing information on devices without consent

3ePrivacy Directive: stipulates that consent must be given beforehand and consciously

4Exception only for technically necessary cookies for the requested service

What to watch out for?

Be wary of deceptively designed cookie banners. Many websites make the 'Accept All' button prominently large and green, while the 'Refuse' button is small and grey. This is not allowed - both options must be equally visible. Pre-ticked boxes for marketing cookies are also prohibited.

1Cookie banners must appear before placing cookies, not afterwards

2'Accept' and 'Refuse' buttons must be equally visible and accessible

3Websites cannot automatically activate all cookies (pre-ticking)

4You must be able to easily modify your choices via cookie settings

Practical example

Imagine you visit an online store and are presented with a cookie banner. The website may immediately place functional cookies for your shopping cart and login status - these are necessary for basic functionality. But for Google Analytics cookies to track your browsing behavior, Facebook pixels for ads, or YouTube cookies for videos, the website must first ask for your consent. If you choose 'Only functional cookies', the website cannot place any tracking or marketing cookies and everything should still work properly.

What can you do?

If a website illegally places cookies without consent, you can take various steps to protect your rights.

1Check your browser to see which cookies have been placed and remove unwanted ones

2File a complaint with the Dutch Data Protection Authority (AP) through their website

3Demand a written explanation from the website about their cookie use and legal basis

4Consider legal action if there are deliberate violations or damages incurred

Conclusion

Websites may only place functional cookies without consent - for all other cookies they need your explicit consent. You have the right to refuse this consent and change it later, and websites must respect this.

Frequently Asked Questions

What are functional cookies exactly?

Can a website deny me access if I refuse cookies?

How can I see which cookies a website has placed?

What should I do if I see no cookie banner but cookies are still placed?

Can cookies also be placed on mobile apps?

Free analysis

Have a legal question?

Let AI analyse your situation and discover your rights and options instantly.