CookieGate
Start free trial

Dutch DPA sanctions are now public by default, and cookie banners are an enforcement target

4 min read By Comply Ark

Regulation: GDPR

In this post

What changed on 1 September 2026

From 1 September 2026, the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), is legally required to publish every decision in which it imposes an administrative sanction under the GDPR. The duty comes from the Verzamelwet gegevensbescherming, which amended the Dutch GDPR Implementation Act (UAVG) and inserted a new Article 21b.

Until now, the AP published sanctions under its own policy, as a matter of discretion. Publication is now the statutory default. Article 21b(1) requires the AP to publish a decision imposing an administrative sanction, except to the extent that Article 5.1(1), (2) and (5) of the Dutch Open Government Act (Woo) prevents disclosure. The AP has said this covers fines, orders subject to a penalty payment and processing bans.

The timeline

Article 21b(2) builds in a short delay. The decision may not be published until ten working days have passed after the day it was notified to the organisation, unless the organisation has already made it public itself or has said it has no objection to earlier publication.

Under Article 21b(3), if the organisation asks the administrative court for interim relief under Article 8:81 of the General Administrative Law Act (Awb), publication is suspended until the court rules or the request is withdrawn. Article 21b(4) applies the same rules to an AP decision on objection that imposes a sanction.

In practice, an organisation that does not go to court has about two weeks between being told of a sanction and seeing it published.

Online tracking is already a priority for the AP. Its 2026 annual plan and its strategic focus for 2026 to 2028 name three priorities: mass surveillance, artificial intelligence and digital resilience. The AP puts online tracking within mass surveillance, noting that technologies such as online tracking and camera surveillance make it easier for organisations to follow people systematically and at scale.

Cookie banners are where this shows up in practice. In April 2025 the AP sent warning letters to 50 organisations, including webshops, media companies and insurers, over misleading cookie banners or tracking cookies placed without valid consent. It gave them three months to fix the problems before it would open an investigation, with a fine as a possible outcome. The AP described those letters as the first of around 500 it intends to send each year, and said it monitors about 10,000 Dutch websites to find likely violations. The problems it flagged are familiar: cookies placed before the visitor chooses, tracking consent ticked in advance, and a “reject” option that only appears in a second window.

The AP has also issued a cookie fine. In 2024 it fined A.S. Watson €600,000 over tracking cookies on the Kruidvat website. On objection, the AP itself cut the fine to €50,000. It gave four reasons: the procedure had taken too long, the company admitted the violation, the violation was of limited seriousness, and a comparable case had ended with a comparable fine. The reduction came from the AP, not from a court.

Put these together. The AP already runs a large, structured programme against non-compliant cookie banners, and any sanction that programme produces will now be published by law, normally within about two weeks of notification. A cookie fine in the Netherlands now comes with a public, named enforcement record.

What is not yet clear

The rule has been in force for about a month. At the time of writing we have not seen a cookie-related sanction published under Article 21b, so we cannot yet say how the AP will apply it in practice: how it uses the Woo exceptions, or how often organisations seek interim relief to delay publication.

The practical takeaway

For any organisation with a Dutch-facing website, a banner that fires trackers before consent, or that makes rejecting harder than accepting, now carries publication risk as well as fine risk. Legal and communications teams should plan on the basis that a sanction will become public within weeks.

The ten-working-day window is only time to seek interim relief. It is not time to fix the banner. Fixing the banner has to happen before the AP’s warning letter arrives, or within the three months that follow it. The test is simple. Open your site in a private window, inspect cookies and network requests before touching the banner, and check that reject is as easy to reach as accept.

Sources

enforcementcookiestransparencydpagdpr

Comply Ark Regulatory infrastructure company. Builds CookieGate.

If this applies to your site.

CookieGate holds non-essential tags until the visitor decides, resolves the right law by location, and prints a receipt per decision.

Start free trial

15 days. Card required. Nothing is charged before day 15.

How CookieGate handles the GDPR