By Marc Alexander

The Dutch regulator spent 2025 writing to websites about their cookie banners, and it had a fine against a household-name retailer to point at. The Netherlands also has something most EU countries don't: a written exemption for low-impact analytics. Here's how both apply to GA4.

The rules.

Dutch cookie rules sit in the Telecommunications Act, which implements the EU's ePrivacy rules, with the GDPR governing the data. The regulator is the Autoriteit Persoonsgegevens, the AP. The basics are the familiar European ones:

  • Consent before non-essential cookies, including advertising and social pixels
  • Real consent. No pre-ticked boxes, no "by continuing you agree", and rejecting as easy as accepting.
  • An exemption for analytics with little privacy impact. The Dutch law allows analytics cookies without consent when they have no, or only a minor, effect on the visitor's privacy. That's the clause site owners reach for with Google Analytics.

The AP's campaign.

In 2024 the AP fined the owner of Kruidvat.nl over tracking cookies set without valid consent. The fine was 600,000 euros. The owner objected, and in 2025 the AP itself, reviewing its own decision, cut it to 50,000 euros, but the finding stood: a banner that steers people into accepting isn't consent.

In 2025 the AP wrote to more than 200 Dutch websites about misleading banners, with a deadline to fix them. About three quarters did, and the AP has since opened enforcement against those that didn't.

The letters haven't stopped. By October 2026 the AP had warned around 100 more organisations, including in media, health and welfare, and insurance, and about seven in ten fixed their banners. On 16 October it opened investigations into two that didn't, both over banners with no visible button to refuse tracking cookies.

It picks its targets from continuous monitoring of around 10,000 Dutch websites, and has said that cookies and tracking before consent stay a priority through 2028. The things it looks for are the things any scanner finds: cookies before a choice, a hidden reject option, and pre-selected categories.

Where GA4 stands.

The analytics exemption is the interesting part. The AP's guide to a privacy-friendly Google Analytics setup, under which the tool could be used without consent, was written for Universal Analytics: a processing agreement with Google, IP addresses shortened, data sharing switched off, and no use with other Google services.

GA4 collects differently and links to Google Ads by design, and the AP hasn't published an equivalent for it.

Marc Alexander's view: a GA4 property that's used only to measure the site, with Google Signals off, ads personalisation off, data sharing settings off and nothing linked, is the closest GA4 comes to the exemption. Most businesses want the Google Ads link, and at that point the exemption is gone and consent is the only safe footing. Either way:

  • Consent Mode v2 is required for advertising. The Netherlands is in the EEA, so Google needs the signals for remarketing and audiences.
  • Every ad pixel waits. Meta, LinkedIn, TikTok and Pinterest all need consent before they load, exemption or not.
  • Transfers. Covered by the EU-US Data Privacy Framework, as explained in GA4 and EU data transfers.

Where Dutch sites usually go wrong.

  1. Relying on the analytics exemption while Google Ads is linked and remarketing is on
  2. A banner with "Akkoord" in a large button and "Weigeren" as a text link
  3. Tags that fire before the banner is answered, because the consent manager and Tag Manager aren't connected
  4. Consent Mode missing or defaulting to granted
  5. A privacy statement that still describes Universal Analytics

What to check.

  1. Open the site in a private window and, before touching the banner, watch the network requests
  2. Reject, reload and check again
  3. Accept analytics only, and confirm the ad pixels still wait
  4. Check what's linked to the GA4 property and which data sharing settings are on
  5. Test Consent Mode with the Consent Mode v2 testing guide

The wider picture is in GA4 and EU consent rules. Marc sets up GA4, Tag Manager and Consent Mode for Dutch and other European businesses, with prices in euros. The free tracking checker shows what a page loads before anyone chooses.

Sources.

Checked on 6 November 2026.