Do I need a cookie banner with Nvivio?

In short. In cookie mode you need consent, in both countries. In privacy mode (the default), Nvivio stores nothing on your visitor’s device. In the Netherlands, the law has an exemption for analytics with little or no impact on privacy, and Nvivio’s privacy mode is built to fit it. In Belgium there is no such exemption, and the regulator asks consent for analytics, even for its own cookieless tool. Whether the cookie rule applies to cookieless measurement at all has not been settled there. This page helps you decide; it is not legal advice, and the regulators below have the last word.

Two sets of rules

Measuring visits touches two sets of rules. They apply side by side.

1. The cookie rule. Storing information on a visitor’s device, or gaining access to information already on it, needs the visitor’s consent, unless it is strictly necessary for a service the visitor asked for. This comes from article 5(3) of the ePrivacy Directive. In Belgium it is article 10/2 of the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (until 2022 article 129 of the Electronic Communications Act); in the Netherlands article 11.7a of the Telecommunicatiewet. It applies to every technique, not only to cookies. In its Guidelines 2/2023 on the technical scope of article 5(3) (final version of 7 October 2024), the European Data Protection Board reads it broadly: a script that makes the browser send information about the device can also be “gaining access”.

2. The GDPR. When you process personal data, such as a pseudonymous visitor code, you need a legal basis (article 6) and you must tell your visitors (articles 13 and 14). For simple statistics about your own website, that basis is usually your legitimate interest (article 6(1)(f)), after weighing it against your visitors’ interests and with a way to object (article 21).

What Nvivio does in privacy mode

These are the facts you or your adviser can weigh:

• No cookies, no local storage, nothing stored on the device. The script only reads whether the visitor objected (the cookie _nvivio_sid=0, which exists only if the visitor set it by unticking the box).
• The script reads the address and title of the page, the referring page, the width of the screen and the language of the browser, and sends them to nviv.io with the request.
• The IP address and the browser are used in memory, together with a key that changes every day, to recognise a visitor for one day only. The IP address is never stored; the daily key is deleted after 26 hours. Nobody is followed across days or across websites.
• Addresses are cleaned: unknown parameters are dropped, email addresses in paths are replaced.
• The data is stored in the EU, processed only for you under our Data Processing Agreement, and never shared with third parties for their own purposes.
• Browsers that send Global Privacy Control are not measured. Visitors can object with one box on your privacy page.

The Netherlands

Article 11.7a(3)(b) of the Telecommunicatiewet exempts from consent cookies and similar techniques that are needed to get information about the quality or effectiveness of a website, as long as they have little or no consequences for the privacy of visitors. The Dutch government gives analytics as an example. The Authority for Consumers and Markets (ACM) supervises the cookie rule; the Autoriteit Persoonsgegevens (AP) supervises the GDPR.

Our view: Nvivio’s privacy mode is built to fit this exemption: it stores nothing on the device, does not identify visitors, does not follow them across days or websites, keeps the IP address out of storage and shares nothing with others. You still have to inform your visitors and have a legal basis under the GDPR (see What to do in any case).

Belgium

Belgian law has no exemption for analytics. The Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, GBA / Autorité de protection des données, APD) supervises both the cookie rule and the GDPR. Its cookie checklist and its decisions (such as decision 85/2022 of the Litigation Chamber) treat analytics cookies as needing prior consent. On its own website, the GBA uses a cookieless analytics tool only after visitors consent.

As far as we know, the GBA has not published a decision on cookieless measurement like Nvivio’s privacy mode. There are two readings:

• Narrow: the cookie rule is about storing information on the device or reading what is stored there. Nvivio’s privacy mode does neither (apart from the objection the visitor set), so only the GDPR applies, and legitimate interest can be the basis.
• Broad, in line with the EDPB’s guidelines: a script that makes the browser send the screen width and the language gains access to information on the device. Without an exemption in Belgian law, you would then need consent.

Our view: we cannot tell you which reading the GBA or a court would follow. If your website mainly serves visitors in Belgium and you want no risk at all, load Nvivio only after your visitors consent (your cookie banner then loads the script), or ask your own adviser. If you measure without consent, base it on your own assessment, document it, and do everything in the next section.

In cookie mode

Cookie mode stores a cookie with an identifier on the device for about 13 months, to recognise visitors across days. That needs consent under the cookie rule, in both countries.

• Call nvivio.consent() in your cookie banner once a visitor consents. Until then, Nvivio counts the visitor as in privacy mode, without the cookie.
• Do not use data-consent="none" where consent is needed.
• Make refusing as easy as accepting, and let visitors withdraw their consent at any time.

What to do in any case

1. Mention Nvivio in your privacy notice. For example:

   We use Nvivio, a web analytics service of Monto Bleu BV (Belgium), to count visits to our website and to see how it is used. Nvivio does not use cookies, does not store your IP address and does not follow you across days or other websites. The data is stored in the European Union and processed only on our behalf. We do this on the basis of our legitimate interest in understanding and improving our website. Visits are kept for [period of your plan]. You can object below.

   In cookie mode, say instead that Nvivio uses one cookie to recognise you on later visits, only after your consent, for about 13 months.

2. Add the objection box to your privacy page: <script defer src="https://nviv.io/optout.js"></script>. See the documentation.

3. Keep your records. Add Nvivio to your record of processing activities (article 30 GDPR). Our Data Processing Agreement applies automatically; its annexes describe the processing and the security measures.

4. Write down your assessment if you rely on legitimate interest, or on the Dutch exemption.

5. Check the regulators’ pages now and then; the rules are under discussion at EU level. In November 2025 the European Commission proposed changes (the “Digital Omnibus”); until any change is adopted and in force, the rules above apply.

The regulators

• Belgium: Gegevensbeschermingsautoriteit / Autorité de protection des données, cookie checklist and dataprotectionauthority.be.
• The Netherlands: Autoriteit Persoonsgegevens, ACM and the government’s answer to may a website place cookies without asking? (in Dutch).
• EU: European Data Protection Board, Guidelines 2/2023 on the technical scope of article 5(3) of the ePrivacy Directive.

We checked these sources on 25 October 2026. This page explains the rules as we understand them; it is not legal advice and does not replace advice for your situation. We are not liable for decisions you base on it.

Versions

• 1.0, 25 October 2026: first version.