Do I need a cookie banner for analytics in the Netherlands?
The Dutch law itself exempts cookies and similar techniques that measure the quality or effectiveness of a site, as long as they have no or only slight consequences for the visitor's privacy; the supervisor says analytics cookies with little privacy impact may be placed without consent, as long as you tell visitors.
The rule
- Supervised by
- Authority for Consumers and Markets (Autoriteit Consument & Markt) for the cookie rule; the Autoriteit Persoonsgegevens for the GDPR (ACM)
- Written in
- Telecommunicatiewet, Article 11.7a, paragraph 3, under b
The conditions of the exemption
- The storage or access serves to obtain information about the quality or effectiveness of your own service
- It has no or only slight consequences for the privacy of the visitor
- You tell visitors that you measure, in your privacy notice
- Measurement that follows a visitor across services, or profiles one, is privacy-sensitive and needs consent
What the regulator and the courts have said
- 11 March 2015: The exemption for analytics enters into force Parliament narrowed the cookie rule so that measuring the quality or effectiveness of a site no longer needs consent when the privacy impact is slight; the text has stood since.
Tool by tool
The same question for the tools people use most. Tools that work without cookies get the same verdict as Nvivio.
| Tool | Banner needed? | Why |
|---|---|---|
| Google Analytics 4, as it ships | Yes | Sets the cookies _ga and _ga_<id> for two years to tell users apart. As it ships it needs consent in the Netherlands. Only a stripped-down setup could fall under the exemption, and whether yours does is your own assessment. |
| Google Analytics 4 with consent mode | Yes | Consent mode adapts Google's tags to the choice a visitor made in a banner. It is a way to handle consent, not an exemption from it. |
| Matomo without cookies | No | With cookies turned off and the IP address shortened, it stores nothing on the device and measures only for you. |
| Plausible or Fathom | No | No cookies and no identifier that lasts beyond a day, measurement for you only. |
| Nvivio, privacy mode | No | No cookie, nothing on the device, the IP address never stored, a visitor code that changes every day, reports as totals. |
| Nvivio, cookie mode | Yes | Places one first-party cookie to recognise a visitor over months. That needs consent, and Nvivio says so. |
| Heatmaps and session recordings | Yes | They record what one visitor did, usually with a cookie, and are never only audience measurement. |
What changes with the Digital Omnibus
The EU is rewriting the cookie rule. Both the Commission's proposal and the Council's mandate exempt aggregated audience measurement by the provider of a site, or by a third party on its behalf, from consent. The text is not law yet.
The Netherlands already has what the Digital Omnibus proposes, in its own words. The EU text would replace the Dutch wording with one definition for every member state; the practical answer for privacy-friendly measurement stays the same. Where the Digital Omnibus stands
Set it up without a banner
Three steps, in the order that keeps you on the right side of the rule in the Netherlands.
- Add the Nvivio script to your site in privacy mode, the default: no cookie, nothing on the device.
- Mention Nvivio in your privacy notice, with the objection box, so visitors can opt out with one click.
- If you keep another tool that sets cookies, load it only after consent, or drop it.
Frequently asked questions
Is first-party analytics exempt from consent in the Netherlands?
Yes, under conditions: measurement for your own site only, statistics that identify nobody, no tracking across sites, and visitors told about it. First-party alone is not enough; a first-party tool that profiles visitors still needs consent.
Does Google's consent mode v2 remove the banner?
No. Consent mode tells Google's tags what the visitor chose in your banner and sends cookieless pings when consent is refused. It presumes a banner; it does not replace one, and the pings themselves are not covered by any exemption in the Netherlands.
Can I keep Google Analytics 4 next to Nvivio?
Yes, as long as Google Analytics loads only after consent. Nvivio measures everyone in privacy mode, so you keep complete numbers; Google Analytics then shows the consenting part, with its own tools and its data in the United States.
My visitors come from several countries. Which rule applies?
The rules of every country whose residents you measure, not only the one you are in. Follow the strictest country that matters to you, or load the tool that needs consent only after consent there. A tool that needs no consent anywhere, like Nvivio in privacy mode, avoids the question.
Is this legal advice?
No. It is general information, checked against the sources below on the date shown. Rules and readings change; a decision for your site is yours, or your adviser's.
Nearby countries
Sources
- Authority for Consumers and Markets, on placing cookies: Cookies plaatsen (acm.nl) · accessed 4 November 2026
- The Dutch government's law database, Telecommunicatiewet: Artikel 11.7a Telecommunicatiewet (wetten.overheid.nl) · accessed 4 November 2026
- Autoriteit Persoonsgegevens: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) · accessed 4 November 2026
This is general information, not legal advice.