Many cookie banners show two buttons on the first screen: “Accept all” and “Settings”. Anyone who wants to refuse has to click through first. That used to be common, but it is not allowed. In both the Netherlands and Belgium, the regulators are clear that refusing must be as easy as accepting. And in the Netherlands, this is now being actively checked.

Why the banner exists

Tracking someone's online behaviour is only allowed after the visitor's explicit consent. You ask for that consent through your cookie banner, and the banner has to meet the legal requirements, as Thuiswinkel.org sums it up. So it is not about the banner itself, but about what sits behind it: tracking cookies, ad pixels, analytics.

A banner without a visible reject button nudges people towards yes. According to the Dutch Data Protection Authority (AP), visitors accept tracking cookies more quickly as a result. That is why the AP calls such a banner misleading.

Why it matters now

On 16 October 2026 the AP announced that it had opened an investigation into the websites of two organisations that keep using a misleading cookie banner, even after an explanation and a warning, Security.nl reports. Which organisations they are has not been made public. Their banner has no directly visible button to reject tracking cookies. That is exactly the situation with only “Accept all” and “Settings”.

Those two are the tip of the iceberg. In the months before, the AP warned around 100 organisations, including ones in media, health and social care, and insurance, according to Security Management. The AP believes rejecting tracking cookies must be as easy as accepting them, so a directly visible reject button has to sit next to “accept”. Since 2024 the AP has been checking more often whether organisations ask for consent correctly.

By November 2025 the AP had already warned more than 200 websites about their banner, and according to Thuiswinkel.org the AP uses software to check the cookie banners of tens of thousands of websites at once. You do not have to be a big player to end up in that sweep.

After a warning you get time to fix your banner. Around 70 percent do. Those who don't can expect an investigation and possibly a fine. For reference: Kruidvat was fined 600,000 euros in 2024 for tracking cookies, which was reduced to 50,000 euros a year later.

What the Belgian DPA says

In Belgium, the cookie checklist of the Data Protection Authority (GBA) is very concrete. You may not offer an “accept all cookies” button without a button on the same layer to reject all cookies that are not strictly necessary. A footnote says it outright: a “manage settings” button next to “accept all” is not enough.

The checklist also says:

  • No cookie walls and no deceptive design, such as steering with colour. A good example according to the GBA: “reject all” and “accept all” displayed in the same way.
  • Cookies that are not strictly necessary may only be placed or read after valid consent. Continuing to browse, closing the banner or browser settings do not count as consent. Pre-ticked boxes are not allowed on any layer.
  • The first layer states at least who places the cookies, how to accept or refuse, what the consequences are, and that and how you can withdraw consent.
  • Counting visitors is in principle not strictly necessary. Cookies for load balancing, language choice, cookie preferences and the shopping cart are allowed without consent.

The GBA itself calls the checklist incomplete and merely a tool, with no new obligations. So it is not a new rule, but a clear reading of what already applied.

What to do, in this order

  1. Put a “Reject all” button next to “Accept all” on the first layer, both styled the same way: same size, same colour, same position. A “Settings” button alone is not enough.
  2. Do not load tracking or analytics cookies before the visitor consents. Open your site in a private window and see which cookies and scripts load before you click anything. Check for each cookie whether it is truly strictly necessary.
  3. Let visitors choose per purpose on a second layer, without pre-ticked boxes. Your own advertising or profiling and that of third parties are separate purposes. The full cookie list per category, with purpose, retention period and recipients, can sit on a lower layer.
  4. Add a clearly visible link or button on your site that lets visitors withdraw consent in one click. Then test that it actually works: after withdrawal, those cookies must no longer be placed or read.
  5. Store cookie preferences for 6 months in principle. Give your cookie policy a date and version number, keep old versions and track how your banner changed over time.
  6. Received a letter from the AP? Fix your banner within the deadline you are given. Ignoring it risks an investigation and possibly a fine.
  7. Then compare your banner with the rules of thumb for clear cookie banners that the AP publishes on its website. Thuiswinkel.org recommends this too.

One thought I always add: the AP points out that you must make clear which data you collect through your website, for what purpose and with whom you share it. The more data you collect, the greater the risks in a hack or data breach. Every pixel you don't need is one less to explain in your banner.

When to outsource it

Adding the reject button is a setting in many cookie tools. The hard part is steps 2 and 4: checking which scripts really only load after consent, and whether withdrawal actually works. If your site runs on a theme with lots of plugins, a tag manager and several marketing pixels, that is not a quick side job.

I include this kind of check in maintenance and security: adjusting the banner, going through the scripts and testing what happens before and after consent. If you have already received a letter from the AP or are unsure whether your banner is in order, get in touch. The sooner you fix it, the smaller the chance you end up among the organisations that didn't.