All regulations / EU Privacy
ePrivacy & cookies
Know the rule before it knows you.
Consent for cookies, trackers and direct marketing, enforced in the Netherlands by the AP and the ACM.
What it is
The ePrivacy rules govern storing or reading information on a user's device (cookies, pixels, SDKs, fingerprinting) and electronic direct marketing. Non-essential cookies require prior, freely given consent at GDPR standard. Marketing by email, SMS and telephone has its own consent and opt-out rules, which in the Netherlands changed again in 2026.
This applies to you if
- Your website or app uses analytics, advertising, A/B testing or social plugins
- You send marketing emails, messages or make marketing calls
- You use consent management platforms or run cookie paywalls
What it asks of you
- Prior consent for non-essential cookies, with reject as easy as accept, no pre-ticked boxes and no dark patterns
- Clear information on who places what and why; withdrawal as easy as giving consent
- Opt-in for electronic marketing, with a working unsubscribe in every message
- Respect of the Dutch do-not-call register and the new telemarketing rules
What it costs to ignore
GDPR-level fines where personal data is involved; ACM fines under the Telecommunicatiewet; enforcement on cookie walls and dark patterns is active.
Key dates
In force since 2002, amended 2009; Dutch telemarketing rules tightened from 2026. The proposed Digital Omnibus would move cookie rules into the GDPR and recognise browser-level signals.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.