Cookie scan

What we do

Within an organization, there may be uncertainty regarding the various cookies being used. Our lawyers and legal experts from the Privacy and Data Protection practice group can conduct an analysis of the different cookies within the organization. Based on this analysis, the legal implications for the organization under the General Data Protection Regulation (GDPR) will be examined. For instance, it may be necessary to ask website users for consent for certain cookies.

Do you have any questions regarding the execution of a cookie scan? Please contact us.

What is a cookie scan?

A cookie scan is a structured investigation in which all cookies and similar technologies (such as pixels, tags, and local storage) on your website are mapped out. For each cookie, it is determined which party places the cookie, what purpose it serves, how long the cookie is retained, and whether personal data is processed. Based on this, our lawyers and (corporate) legal experts assess whether consent is required for a cookie and whether your cookie banner and cookie declaration are legally compliant. A cookie scan thus forms the foundation for cookie compliance, whether you are an international corporation or the baker on the corner with a simple business website.

The legal framework: Telecommunications Act and GDPR

In the Netherlands, two legal regimes apply side by side to cookies. The core provision is Article 11.7a of the Telecommunications Act: this stipulates that, in principle, you need consent before placing or reading cookies, with the exception of strictly necessary (functional) cookies and cookies that serve solely to transmit information or that have no or minimal impact on privacy. As soon as a cookie processes personal data – such as tracking and marketing cookies that track browsing behavior across multiple websites – the General Data Protection Regulation (GDPR) also applies. The consent must then meet the strict GDPR requirements: free, specific, informed, and unambiguous (Article 4 and Article 7 GDPR). A cookie scan reveals which regime applies to which cookie.

Supervision and enforcement: AP and ACM

Compliance with cookie rules is monitored by two supervisory authorities. The Authority for Consumers & Markets (ACM) supervises the Telecommunications Act, while the Dutch Data Protection Authority (AP) supervises the GDPR aspects of cookies. Since 2024, the AP has actively enforced regulations regarding cookie banners and monitors large numbers of websites using automated software. In 2025, the AP warned more than 200 organizations about misleading cookie banners; the regulator launched investigations against organizations that did not modify their banners, which can lead to substantial fines. The fact that the risks are real is evidenced by the €600,000 fine imposed by the AP in 2024 on the operator of a well-known drugstore for placing tracking cookies without valid consent.

Types of cookies and when consent is required

During a cookie scan, we distinguish the cookies by their function, because that determines whether consent is required:

• Functional (necessary) cookies are required for the website to work, for example for logging in or the shopping cart. No consent is required for this.
• Analytical cookies measure website usage. Depending on the privacy settings, these may be consent-free; if not, consent is required.
• Tracking and marketing cookies follow visitors (often across multiple websites) for personalized advertisements. Prior, explicit consent is always required for this.

Requirements for your cookie banner

The enforcement by the AP results in a clear set of requirements that a cookie banner must meet. Our cookie scan tests your banner against the following points, among others:

• The visitor receives clear information about which cookies are used and for what purpose, without vague or leading wording.
• Consent is actively given; pre-checked boxes are not allowed.
• The “Accept All” and “Reject All” buttons are equally prominent and visible on the same layer (no dark patterns).
• The visitor can make a choice per category of cookies.
• Consent can be easily withdrawn, and after withdrawal, the placement of the relevant cookies stops.
• Refusing cookies does not unreasonably restrict access to the website.

Cookie scan in our privacy approach

A cookie scan rarely stands alone. The results often lead to updating your processing register, your privacy statement, and your cookie statement. For websites with frequent or high-risk processing activities, a DPIA (Data Protection Impact Audit) be appropriate, and a cookie scan complements a broader privacy audit. Online stores often combine the scan with advice on e-commerce, the webshop, and privacy. The cookie scan is therefore an integral part of our broader expertise in Privacy and Data Protection.

Why MKB Juristen?

At MKB Juristen, you work with mixed teams of lawyers and in-house counsel. This means that you receive not only a legal assessment but also practical advice tailored to your organization – from an international corporation to the baker on the corner. We translate the results of the cookie scan into concrete actions: a comprehensive cookie banner, a correct cookie declaration, and, where necessary, agreements with your suppliers of analytics and marketing tools. This way, you avoid enforcement by the Dutch Data Protection Authority (AP) or the Dutch Authority for Consumers and Markets (ACM) and offer your visitors a genuine choice.