Is a cookie banner mandatory? What the Belgian rules say

Yes, as soon as your site stores or reads anything on a visitor's device that isn't strictly necessary: Google Analytics cookies, a Meta advertising pixel, a YouTube video or a Google Maps map. According to the Belgian Data Protection Authority (GBA in Dutch, APD in French), strictly necessary cookies, such as a shopping cart, a login or a language choice, don't need consent, but you do have to explain what they do. And cookieless analytics? They help a lot, but the authority hasn't said they never need consent.

What does the rule say?

You may only store or read something on a visitor's device if you first tell them clearly why, and they then give their consent. There are two exceptions: when it serves only to send a message over the internet, or when it's strictly necessary for something the visitor asked for. The rule comes from the EU and is in the Belgian data protection act of 30 July 2018, article 10/2 (framework act). Until 2022 it was in the electronic communications act; older texts still refer to that.

It isn't only about cookies. According to the authority, the rule also covers other techniques that store or recognise something on the device, such as pixels (Data Protection Authority). The European Data Protection Board (EDPB), which brings together the EU's privacy regulators, also includes scripts that make the browser send data, and sometimes even tracking visitors by their IP address (EDPB).

When don't you need consent?

For cookies that are strictly necessary for something the visitor asks for, or to make your site work (Data Protection Authority):

• their shopping cart, or a form spread over several pages;

• their login, for example to your client portal;

• temporarily storing their language choice;

• their choice in the cookie banner, in principle for six months at most, according to the authority.

For these cookies too, you explain what they do. The authority asks for a cookie policy listing, among other things, your cookies, their purpose and their duration. Visitors must be able to find that policy easily, for example through a link. The authority doesn't say whether it should be a separate page or a section of your privacy statement.

Do analytics and advertising cookies always need consent?

In Belgium, yes. For cookies that count visitors there is "no exemption", the authority says, "not even for first-party cookies" (cookies from your own site). Counting visitors is not a service the visitor asked for (Data Protection Authority).

Reading French websites? The French regulator CNIL exempts some audience measurement cookies under certain conditions (CNIL). That exemption doesn't apply in Belgium.

How do you check what your site loads?

Ask your web developer: "Give me a list of all cookies on my site, and of all services from other companies that my site loads." Or check yourself, in Chrome:

1. Open your site in an incognito window and don't click anything in the banner.

2. Right-click the page and choose Inspect. In the Application tab, under Cookies, you'll see which cookies your site has already set (Chrome).

3. Open the Network tab and reload the page. You'll see which addresses your site loads content from (Chrome). If you see names like google-analytics.com, youtube.com or facebook.net, your site is loading something from another company.

If you already see cookies that aren't strictly necessary while you haven't clicked anything yet, there's work to do.

What about a map, a video or fonts?

• A Google Maps map on your contact page needs consent. An image of the map with a "View on Google Maps" link doesn't.

• A YouTube video: only load it when the visitor clicks it, with a line saying YouTube may then set cookies. Until that click, nothing from YouTube reaches your site.

• Google Fonts: your visitor's browser contacts Google to load them. Have them hosted on your own server.

• LinkedIn: a plain link to your company page loads nothing; an embedded LinkedIn button or feed does.

• A form with reCAPTCHA loads a script from Google. Ask your web developer for spam protection that doesn't load anything from another company.

• The login to your client portal is strictly necessary: no consent needed.

Using Google Analytics? You have three choices: a banner that follows the checklist below, switching to cookieless analytics, or removing Google Analytics if you don't look at the numbers anyway.

What should a good cookie banner do?

The authority published a checklist in October 2023 (Data Protection Authority). The main points:

• Ask first, then load. Cookies that aren't strictly necessary only load after consent.

• Refusing must be as easy as accepting. A "Reject all" button next to "Accept all", in the banner itself. A "Settings" button next to "Accept all" isn't enough.

• No tricks. No pre-ticked boxes, no button that stands out by its colour, no consent just because someone keeps browsing or closes the banner.

• No cookie wall. People who refuse must still be able to use your site.

• A choice per purpose (analytics, advertising, social media), at the latest in the window behind "Settings".

• In the banner itself, explain who sets the cookies, how the visitor accepts or refuses, what the consequences are, and that they can withdraw their consent.

• Withdrawing consent must be as easy as giving it, for example with a link at the bottom of every page.

• Keep earlier versions of your banner and cookie policy, with their dates.

• In your visitor's language: in French and Dutch if your site is aimed at both.

Your web developer installs the banner, or you use a ready-made service that follows these points.

What does cookieless analytics change?

Tools such as Plausible count visits without cookies. That changes a lot: no cookie on the device, no data going to an advertising network, and more complete numbers. But it doesn't change everything:

• The rule covers more than cookies. According to the EDPB, a script that sends data from the device can fall under it, and sometimes even tracking visitors by their IP address.

• The authority hasn't published a position on cookieless analytics; at least, we couldn't find one. Plausible itself says you don't need a cookie banner with its tool (Plausible): that's the supplier's view, not the authority's.

• The GDPR still applies. Even without cookies you process personal data, such as IP addresses and what visitors type into your forms. Your privacy statement says what you process and why (GDPR, art. 13).

What's the risk?

A visitor can file a complaint with the authority (Data Protection Authority). The authority can then order you to comply, or fine you: in 2022 the publisher of Knack and Le Vif was fined €50,000 over the cookies on those two sites (decision 85/2022).

Is the rule about to change?

The EU is working on more flexible rules, among other things to allow counting visitors without consent (European Commission, Journal du Net). As of 4 November 2026, that isn't law yet.

So, do you need a cookie banner?

• Yes, if you use Google Analytics, advertising pixels, social media buttons or feeds, embedded videos or maps, or a chat from another company.

• No consent, but you still explain, if you only use strictly necessary cookies.

• If your site counts visitors without cookies and loads nothing from others, the most common reason for a banner disappears. The authority hasn't said explicitly whether that's enough.

• Always a privacy statement.

Kintsu sites set no cookies themselves and load no trackers from others, so they show no cookie banner. They count visits on the server, each time a page is requested: no script runs and nothing is stored on the device. To count a visitor only once a day, the server creates a code from the IP address and the browser type, which is deleted after that day; only the totals remain. We therefore believe that no consent is needed for this count. The authority hasn't confirmed that. If you add something that sets cookies, such as Google Analytics or Google Maps, a banner appears with a button to refuse next to the one to accept. More in Privacy and hosting in the EU.

This article is general information, not legal advice. It reflects what the law and the Belgian Data Protection Authority say as of 4 November 2026. If you're unsure about your own site, ask a lawyer.

Sources

All sources accessed on 4 November 2026.

• Belgian Data Protection Authority, Cookies en andere traceringsmiddelen, updated 17 November 2023 (in Dutch; also in French, not in English)

• Belgian Data Protection Authority, Cookie checklist, October 2023 (in Dutch; also in French)

• Belgian Data Protection Authority, Introduire une plainte (in French; also in Dutch)

• Belgian Data Protection Authority, Decision 85/2022, 25 May 2022 (in Dutch)

• Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, art. 10/2, in force since 10 January 2022 (in Dutch; French on the same site)

• Act of 13 June 2005 on electronic communications, art. 129, repealed on 10 January 2022 (in Dutch; French on the same site)

• EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0 of 7 October 2024

• CNIL, Cookies : solutions pour les outils de mesure d'audience (in French)

• Chrome for Developers, View, add, edit, and delete cookies and Inspect network activity

• Plausible, Data policy

• General Data Protection Regulation (GDPR), art. 13

• European Commission, Digital omnibus regulation proposal, 19 November 2025 (French page; the English page gave an error when we checked)

• Journal du Net, Digital Omnibus : ce que change le mandat du Conseil de l'UE du 21 octobre 2026, 29 October 2026 (in French)