Getting privacy and cookies right on your website

Privacy does not have to slow down your marketing. Mostly it asks for clear choices: what do you measure, why, and when do you ask for consent? This article explains the practical side for a small-business website in the Netherlands, from a hair salon to an online shop. It is not legal advice: if you are unsure about your situation, ask a lawyer or check the guidance of the Dutch Data Protection Authority.

Two laws that apply together

In the Netherlands, two sets of rules cover cookies and personal data on your site.

• The Telecommunications Act: the part known as the cookie law (Telecommunicatiewet). It governs when you may place or read something on a visitor’s device, such as a cookie or a similar technique.
• The GDPR: known in Dutch as the AVG. It governs how you handle personal data, such as a name, email address or IP address. Data from cookies can be personal data too.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) publishes practical guidance on cookies and privacy on its website. That guidance is the best starting point when you are in doubt.

Which cookies are allowed without consent?

Not every cookie is the same. The difference lies in what the cookie does and what it means for your visitor’s privacy.

Functional cookies

Cookies needed to make your site work, such as a shopping basket, a logged-in session, security or remembering a language choice. You do not need consent for these. You do have to inform visitors, for example in your privacy or cookie statement.

Analytical cookies

Cookies that measure how visitors use your site. According to the AP, you may place these without consent if they have little or no impact on your visitors’ privacy and you meet the conditions. Think of agreements with the supplier of your analytics tool, not sharing data for other purposes and limiting what you record about a visitor. If you use an analytics tool in a way that goes further, you do need consent.

Marketing and tracking cookies

Advertising pixels, remarketing and cookies that follow visitors across several sites. For these you ask for consent in advance. In advance means: the cookie is only placed and the script only loads after the visitor has said yes.

A cookie banner that works

A banner is not enough if the scripts already load before someone makes a choice. The technology has to follow the choice. Watch these points:

• Refusing is as easy as accepting: a button to refuse is as visible as the button to accept, not hidden behind an extra screen.
• No pre-ticked boxes: the visitor gives consent actively, themselves.
• Plain language: explain in ordinary words what you measure and who you share data with.
• Withdrawing is always possible: a visitor can change their choice later, for example via a link at the bottom of every page.
• No banner when you do not need one: if you only use functional and privacy-friendly analytical cookies, you need no consent request. Informing visitors remains required.

Forms are privacy too

Cookies get a lot of attention, but most personal data arrives through your forms: a quote request at an installer, an application at a staffing agency, a booking at a restaurant. The GDPR applies in full there.

Ask only what you need

Data minimisation is one of the principles of the GDPR. Ask only for data you really need to follow up the enquiry. A date of birth or a full address does not belong in a first contact form, unless you need it for what the visitor is asking.

Explain what happens

State briefly next to the form what you do with the data and link to your privacy statement. Store enquiries in a secure place, do not forward them to programs that have no use for them, and decide how long you keep them.

Mind your email

Enquiries often arrive by email. A mailbox shared by several people with one password, or a free address on a personal account, is a weak spot. A business email setup with separate accounts per employee and two-step verification makes that easier to control.

How to set it up step by step

1. Take stock: which cookies, scripts and pixels are on your site now?
2. Sort them: functional, analytical or marketing.
3. Configure your analytics in a privacy-friendly way: or choose a tool that collects little data.
4. Load marketing only after consent: and test it in a private window.
5. Update your privacy statement: with what you collect, why, for how long and who you share it with.
6. Review your forms: remove fields you do not use.

Include this in your regular website maintenance as well: every new script or integration comes with the question of which group it belongs to.

How we approach it

On the websites we build, marketing scripts load only after consent and forms ask only what is needed to follow up. Through hosting and care we keep the site secure and up to date. Which texts belong in your privacy statement remains your choice as the controller; we make sure the technology does what it says.