In Belgium you need visitor consent for every cookie that is not strictly necessary, and that includes most analytics. If you ask for consent, refusing must be as easy as accepting. This is how the Belgian data protection authority (GBA, in French APD) describes it. It is not legal advice: for your own case, ask a lawyer.
Do I need a cookie banner on my website in Belgium?
Only if the site places or reads something on the visitor’s device that is not strictly necessary. The Belgian rule is article 10/2 of the Act of 30 July 2018. The GBA applies it to more than cookies: pixels, device fingerprinting and local storage count too. A site with none of these needs no banner.
Which cookies can I use without asking?
Two kinds, according to the GBA:
- Technical cookies that are strictly necessary, such as session cookies for load balancing.
- Functional cookies strictly needed for a service the visitor asked for, such as a language choice, the cookie preferences themselves or the content of a shopping basket.
Everything else needs consent first.
Does analytics need consent?
Yes, in principle. The GBA says an analytics cookie generally does not meet the two conditions for the exemption, because it serves the site owner’s statistics, not a service the visitor asked for. Its checklist adds that counting visitors is in principle not exempt, and notes that some regulators in other member states allow a narrow exemption under strict conditions. Belgium’s GBA does not apply one in its checklist.
The GBA’s own website uses an analytics tool called Plausible, and says the data is used only if you consent. I found no GBA statement that a cookieless tool needs no consent, so asking first is the cautious route.
On the sites I build, the analytics script loads only after the visitor presses accept. Before that choice, nothing optional loads.
What does a valid cookie banner look like?
The GBA publishes a cookie checklist. It calls it a tool, not a list of new obligations. The main points:
| Requirement | In practice |
|---|---|
| Nothing non-essential before consent | No optional cookie placed or read before a valid yes |
| Reject on the same layer as accept | A “manage settings” button next to “accept all” is not enough |
| No deceptive design | For example, no colours that push toward accepting |
| Consent per purpose | At the latest on a second layer |
| Clear information on the first layer | Who sets the cookies, how to accept or refuse, what follows, and the right to withdraw |
| Active consent only | No consent from scrolling, closing the banner or pre-ticked boxes |
| No cookie wall | Access cannot depend on accepting |
| Easy withdrawal | A clearly visible link or button, one click, and it must really have the effect |
On my sites, visitors can withdraw consent from the footer and from the cookies page.
How long can I remember the choice, and what should I keep?
The GBA says cookies that remember a visitor’s choices should be kept for a limited time, and that it considers 6 months reasonable in principle. On my sites the choice therefore expires after six months, and the banner then asks again. The GBA also asks you to keep records showing how your banner changed over time, to keep earlier versions of your cookie policy, and to give the policy a date and a version number.
What has to be in my privacy policy?
When you collect data directly from people, the GBA’s guide for small businesses lists what to tell them. For a small site that means:
- who you are and how to reach you
- why you use the data and on what legal basis
- who receives it, such as a website developer
- whether it leaves the European Economic Area, and on what safeguards
- how long you keep it, or the criteria
- the visitor’s rights, including withdrawing consent and complaining to a supervisory authority
The GBA’s tips: link the policy from the main page and every other page, make it available in all languages of the site, date it, and keep earlier versions.
Which contracts do I need with my host and email provider?
The GBA’s guide says a company that appoints a processor must sign a processing agreement with it. Its example is a company that keeps customer data with a hosting provider: the host acts as a processor. The guide to domain, hosting and email covers who runs what.
What if there is a data leak?
The European Data Protection Board says to notify the data protection authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals. You can report in phases but must justify any delay. Tell the people affected without undue delay when the risk is high. Record every breach, including the ones you do not report.
What must be on my website by law?
The FPS Economy lists what a business website or social media page must show: your name, your address, contact details including an email address, your enterprise number, and your VAT number if your activity is subject to VAT. A phone number is also required if you can conclude distance contracts with consumers. The rule applies to self-employed people too.
In its 2024 checks of 2,158 websites and web pages, the FPS Economy found identity information missing on 47.7% and the enterprise number missing on 45.7%.
Has anyone in Belgium been fined for cookies?
Yes. In decision 85/2022 of 25 May 2022, the GBA’s Litigation Chamber fined Roularta Media Group, publisher of Knack and Le Vif, 50,000 euros. The findings covered statistics cookies placed without consent, pre-ticked boxes for partners and consent withdrawal that did not work. It also ordered the company to comply within three months.
Where does Ovrick fit?
I build sites so nothing optional loads before a choice, which keeps the banner short or removes the need for one. On my sites the Google map is a placeholder with the address and a “Show the map” button, and nothing reaches Google before the click. Every site I build works this way, at no extra cost: the pricing page shows what is included. For a question about your own situation, ask a lawyer.
Where can I read more?
- GBA: cookie checklist (Dutch)
- GBA: cookies and other tracking tools (Dutch)
- GBA: its own cookie policy (Dutch)
- GBA: FAQ brochure for small businesses (Dutch)
- GBA: decision 85/2022 on Knack and Le Vif (Dutch)
- EDPB: when do you need to notify a data breach?
- FPS Economy: what to show on your business website (Dutch)
- FPS Economy: 2024 inspection results (Dutch)