Interpretation and Enforcement of the Cookies Act in the Netherlands

• Anke Verhoeven
• Thomas van Essen

The E-Privacy Directive, which has made it mandatory for EU Member States to implement statutory rules regarding cookies, has already existed for 5 years. Yet much remains unclear on how these, at first sight relatively simple, regulations have to be applied and explained. In our practice we receive many questions from companies that do not know how to deal with cookies in the right way. After five years of discussion about the way that the cookie legislation was implemented in the Netherlands, a proposal to amend the cookie legislation is before the Upper House. This bill seeks to further simplify the use of cookies. It is now a good time to look back at five years of cookie legislation in the Netherlands. This article aims to offer some insight – based on two decisions of the College Bescherming Persoonsgegevens (Dutch Data Protection Authority, or CBP) – into the way in which the cookie regulations of the E-Privacy Directive have been implemented in Dutch law and the way that these regulations are interpreted by the CBP.