Do I need a cookie banner for analytics in Belgium?
The Belgian Data Protection Authority has twice held that statistics cookies are not strictly necessary and need prior consent, and its checklist says no cookie goes before consent; it has not ruled on measurement that sets none.
The rule
- Supervised by
- Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) (GBA/APD)
- Written in
- Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, Article 10/2
There is no exemption for audience measurement: the only exceptions are carrying a communication and a service the visitor asked for.
What the regulator and the courts have said
- 14 May 2025: The Market Court rules in the IAB Europe case The Brussels Market Court endorses the authority's reasoning against the consent framework of the advertising industry: the consent string is personal data and the banners built on it did not give valid consent. A banner is not a formality; what it collects must itself be lawful.
- 25 May 2022: Decision 85/2022 on the cookies of Knack and Le Vif (Roularta) Statistics cookies placed before consent were an infringement: first-party statistics cookies do not necessarily fall under the exception for strictly necessary cookies, and a cookie wall with a pre-ticked choice is no consent.
- 17 December 2019: Decision 12/2019 on cookies and consent Statistics cookies cannot be considered strictly necessary to deliver the service the visitor asked for: that exception serves the visitor, not the publisher, so they need consent.
Tool by tool
The same question for the tools people use most. Tools that work without cookies get the same verdict as Nvivio.
| Tool | Banner needed? | Why |
|---|---|---|
| Google Analytics 4, as it ships | Yes | Sets the cookies _ga and _ga_<id> for two years to tell users apart. Cookies that identify a browser for two years are neither strictly necessary nor anonymous audience measurement, so Belgium asks consent for them. |
| Google Analytics 4 with consent mode | Yes | Consent mode adapts Google's tags to the choice a visitor made in a banner. It is a way to handle consent, not an exemption from it. |
| Matomo without cookies | No, with a note | With cookies turned off and the IP address shortened, it stores nothing on the device and measures only for you. |
| Plausible or Fathom | No, with a note | No cookies and no identifier that lasts beyond a day, measurement for you only. |
| Nvivio, privacy mode | No, with a note | No cookie, nothing on the device, the IP address never stored, a visitor code that changes every day, reports as totals. |
| Nvivio, cookie mode | Yes | Places one first-party cookie to recognise a visitor over months. That needs consent, and Nvivio says so. |
| Heatmaps and session recordings | Yes | They record what one visitor did, usually with a cookie, and are never only audience measurement. |
What changes with the Digital Omnibus
The EU is rewriting the cookie rule. Both the Commission's proposal and the Council's mandate exempt aggregated audience measurement by the provider of a site, or by a third party on its behalf, from consent. The text is not law yet.
Belgium has no exemption today. The Digital Omnibus would write one into EU law for aggregated audience measurement, and Belgium would then apply it like every member state; until it is adopted, nothing changes here. Where the Digital Omnibus stands
Set it up without a banner
Three steps, in the order that keeps you on the right side of the rule in Belgium.
- Add the Nvivio script to your site in privacy mode, the default: no cookie, nothing on the device.
- Mention Nvivio in your privacy notice, with the objection box, so visitors can opt out with one click.
- If you keep another tool that sets cookies, load it only after consent, or drop it.
Frequently asked questions
Is first-party analytics exempt from consent in Belgium?
No. Belgium exempts only what is strictly necessary for a service the visitor asked for, and the regulator does not count statistics among that. First-party or third-party makes no difference to the cookie rule; what matters is whether anything is stored on or read from the device.
Does Google's consent mode v2 remove the banner?
No. Consent mode tells Google's tags what the visitor chose in your banner and sends cookieless pings when consent is refused. It presumes a banner; it does not replace one, and the pings themselves are not covered by any exemption in Belgium.
Can I keep Google Analytics 4 next to Nvivio?
Yes, as long as Google Analytics loads only after consent. Nvivio measures everyone in privacy mode, so you keep complete numbers; Google Analytics then shows the consenting part, with its own tools and its data in the United States.
My visitors come from several countries. Which rule applies?
The rules of every country whose residents you measure, not only the one you are in. Follow the strictest country that matters to you, or load the tool that needs consent only after consent there. A tool that needs no consent anywhere, like Nvivio in privacy mode, avoids the question.
Is this legal advice?
No. It is general information, checked against the sources below on the date shown. Rules and readings change; a decision for your site is yours, or your adviser's.
Nearby countries
Sources
- Data Protection Authority, cookie checklist: Cookie checklist (dataprotectionauthority.be) · accessed 4 November 2026
- Data Protection Authority, Litigation Chamber: Beslissing ten gronde 85/2022 (gegevensbeschermingsautoriteit.be) · accessed 4 November 2026
- Data Protection Authority, Litigation Chamber: Beslissing ten gronde 12/2019 (gegevensbeschermingsautoriteit.be) · accessed 4 November 2026
- Data Protection Authority, news: The Market Court rules in the IAB Europe case (dataprotectionauthority.be) · accessed 4 November 2026
- Belgian Official Journal, the Act of 30 July 2018: Wet van 30 juli 2018 (ejustice.just.fgov.be) · accessed 4 November 2026
This is general information, not legal advice.