Dutch AP: two organisations investigated for banners with no visible reject button

Refusing has to be as easy as accepting. After warning about 100 organisations, the Dutch regulator says around 70% fixed their banners; two that did not are now under investigation.

Autoriteit Persoonsgegevens · Dutch cookie consent rules · Investigation announced 16 October 2026

Investigations opened into two unnamed organisations; no finding or fine

Regulator or court: Autoriteit Persoonsgegevens (AP)
Jurisdiction: Netherlands / European Union
Framework: Dutch cookie consent rules (the announcement cites no article)
Investigation announced: 16 October 2026

Unequal choices or identity checks

The problem

The AP says two organisations "blijven een misleidende cookiebanner gebruiken" (keep using a misleading cookie banner) despite an explanation and a warning. Their banners have "geen direct zichtbare knop" (no directly visible button) to refuse tracking cookies, so visitors are more likely to accept them (AP announcement).

Case record

Authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Jurisdiction: Netherlands
Organisations: Two, not named
Law: Not cited in the announcement
Stage: Investigation opened; announced 16 October 2026
Amount: None; a fine is possible but not decided
Source review: 20 October 2026

What the regulator said

There is no decision yet. The announcement sets out the AP’s position and its enforcement sequence:

Equal choice. "Het moet voor websitebezoekers net zo gemakkelijk zijn om trackingcookies te weigeren als te accepteren." Banners therefore need a directly visible reject button next to "accepteren".
Checks since 2024. The AP has been checking more often whether organisations ask for consent correctly for tracking cookies and similar software, looking among other things at the banner.
Warnings first. In recent months the AP warned about 100 organisations, including in media, care and welfare, and insurance. About 70% then corrected their banner.
Then investigation. Organisations that do not correct it "kan een onderzoek en mogelijk een boete verwachten" (can expect an investigation and possibly a fine).
Consent standard. Tracking cookies may only be placed after freely given consent based on clear and correct information.

Technical issue

What: a first-layer banner with an accept button but no directly visible reject button.
Where: the two organisations' websites; neither is named.
Effect described by the AP: visitors are more likely to accept tracking cookies.

Inth’s technical interpretation: the usual pattern is a prominent accept button with refusal moved to a "settings" link or a second layer. A visitor who wants to refuse needs more clicks than one who accepts. The fix is a reject control in the same layer, with comparable size and wording.

// First layer offers one-click accept; refusal needs a second layer
banner.render({
  buttons: [{ label: 'Accept all', action: () => consent.grant(['analytics', 'marketing']) }],
  links: [{ label: 'Settings', action: openPreferences }], // reject only in here
});

// Equal choice on the first layer
banner.render({
  buttons: [
    { label: 'Accept all', action: () => consent.grant(['analytics', 'marketing']) },
    { label: 'Reject all', action: () => consent.deny(['analytics', 'marketing']) },
  ],
  links: [{ label: 'Settings', action: openPreferences }],
});

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

2024AP starts checking consent for tracking cookies more often
11 November 2025Earlier AP release: about three quarters of websites fixed a misleading banner after a warning; investigation started into refusers (linked from the 16 October 2026 announcement; not reviewed in detail)
Recent months before October 2026About 100 organisations warned; about 70% corrected their banner
16 October 2026AP announces investigations into two organisations

Outcome

None yet. The AP has opened investigations and says a fine is possible. It has not named the organisations, stated a legal basis or published findings.

What it cost

Dutch AP reject-button investigations costs
Item	Amount	Source
Fine	None decided	[AP announcement](https://www.autoriteitpersoonsgegevens.nl/actueel/ap-onderzoekt-websites-vanwege-misleidende-cookiebanner)
Remediation for warned organisations	Not stated in the cited record

Why it matters

Warn, then investigate. The AP sends warnings in batches and follows up on those that do not act. A warning letter is the moment to fix the banner.
Sector sweeps. Media, care and welfare, and insurance were named, so organisations in those sectors are more likely to be checked.
Same idea in court. A German appeal court barred a banner with no first-layer reject option; compare WetterOnline.

Related issue page: Unequal choices or identity checks.

How Inth catches this

Consent banner: can show accept and reject in the first layer with equal prominence, and records which option the visitor chose.
Website audit: captures the first-layer banner as displayed, by region and device, and flags a layer that offers accept without a visible reject control.
Evidence: screenshots of the first layer, consent records with choice, country and banner version, and the trackers that loaded after each choice.

Limit: whether a given button design is "directly visible" is a judgement for the regulator; Inth records what was shown.

Checks for your own systems

In the repository

Find the banner configuration and confirm the first layer has a reject action, not only accept and settings.
Check the reject action is not hidden behind a scroll, a collapsed section or a text link styled as body copy.

In the browser and network

Open the site in a clean profile from the Netherlands on mobile and desktop and count clicks to refuse.
After refusing, confirm no tracking requests are sent.

With the people responsible

Ask whether anyone received an AP warning letter and what was changed in response.
Agree who signs off on banner design changes.

Sources and limits

AP: AP onderzoekt websites vanwege misleidende cookiebanner, 16 October 2026 (Dutch)

The announcement does not name the two organisations, give their sector or cite a legal article. The 11 November 2025 release it links to was not reviewed in detail. Translations from Dutch are ours.

Source review: 20 October 2026. This page describes the cited announcement and procedural stage. It does not audit any organisation’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.