[Enforcement library](/enforcement)

# Dutch AP: two organisations investigated for banners with no visible reject button

The Dutch AP opened investigations into two organisations that kept cookie banners without a directly visible reject button after an explanation and a warning. The organisations are not named and nothing has been decided.

## Key facts

- **Regulator or court:** Autoriteit Persoonsgegevens (AP)
- **Jurisdiction:** Netherlands / European Union
- **Framework:** Dutch cookie consent rules (the announcement cites no article)
- **Record date:** 2026-10-16
- **Procedural status:** Investigations opened into two unnamed organisations; no finding or fine

Refusing has to be as easy as accepting. After warning about 100 organisations, the Dutch regulator says around 70% fixed their banners; two that did not are now under investigation.

Autoriteit Persoonsgegevens · Dutch cookie consent rules · Investigation announced 16 October 2026

- The problem
- Case record
- What the regulator said
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

The AP says two organisations "blijven een misleidende cookiebanner gebruiken" (keep using a misleading cookie banner) despite an explanation and a warning. Their banners have "geen direct zichtbare knop" (no directly visible button) to refuse tracking cookies, so visitors are more likely to accept them ([AP announcement](https://www.autoriteitpersoonsgegevens.nl/actueel/ap-onderzoekt-websites-vanwege-misleidende-cookiebanner)).

## Case record

| Field | Record |
| --- | --- |
| Authority | Autoriteit Persoonsgegevens (Dutch Data Protection Authority) |
| Jurisdiction | Netherlands |
| Organisations | Two, not named |
| Law | Not cited in the announcement |
| Stage | Investigation opened; announced 16 October 2026 |
| Amount | None; a fine is possible but not decided |
| Source review | 20 October 2026 |

## What the regulator said

There is no decision yet. The announcement sets out the AP's position and its enforcement sequence:

- **Equal choice.** "Het moet voor websitebezoekers net zo gemakkelijk zijn om trackingcookies te weigeren als te accepteren." Banners therefore need a directly visible reject button next to "accepteren".
- **Checks since 2024.** The AP has been checking more often whether organisations ask for consent correctly for tracking cookies and similar software, looking among other things at the banner.
- **Warnings first.** In recent months the AP warned about 100 organisations, including in media, care and welfare, and insurance. About 70% then corrected their banner.
- **Then investigation.** Organisations that do not correct it "kan een onderzoek en mogelijk een boete verwachten" (can expect an investigation and possibly a fine).
- **Consent standard.** Tracking cookies may only be placed after freely given consent based on clear and correct information.

## Technical issue

- **What:** a first-layer banner with an accept button but no directly visible reject button.
- **Where:** the two organisations' websites; neither is named.
- **Effect described by the AP:** visitors are more likely to accept tracking cookies.

**Inth's technical interpretation:** the usual pattern is a prominent accept button with refusal moved to a "settings" link or a second layer. A visitor who wants to refuse needs more clicks than one who accepts. The fix is a reject control in the same layer, with comparable size and wording.

```javascript
// First layer offers one-click accept; refusal needs a second layer
banner.render({
  buttons: [{ label: 'Accept all', action: () => consent.grant(['analytics', 'marketing']) }],
  links: [{ label: 'Settings', action: openPreferences }], // reject only in here
});

// Equal choice on the first layer
banner.render({
  buttons: [
    { label: 'Accept all', action: () => consent.grant(['analytics', 'marketing']) },
    { label: 'Reject all', action: () => consent.deny(['analytics', 'marketing']) },
  ],
  links: [{ label: 'Settings', action: openPreferences }],
});
```

Illustrative pattern, not the defendant's code. Generic consent API, not a specific c15t call.

## Timeline

| Date | Event |
| --- | --- |
| 2024 | AP starts checking consent for tracking cookies more often |
| 11 November 2025 | Earlier AP release: about three quarters of websites fixed a misleading banner after a warning; investigation started into refusers (linked from the 16 October 2026 announcement; not reviewed in detail) |
| Recent months before October 2026 | About 100 organisations warned; about 70% corrected their banner |
| 16 October 2026 | AP announces investigations into two organisations |

## Outcome

None yet. The AP has opened investigations and says a fine is possible. It has not named the organisations, stated a legal basis or published findings.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Fine | None decided | \[AP announcement\](https://www.autoriteitpersoonsgegevens.nl/actueel/ap-onderzoekt-websites-vanwege-misleidende-cookiebanner) |
| Remediation for warned organisations | Not stated in the cited record |  |

## Why it matters

- **Warn, then investigate.** The AP sends warnings in batches and follows up on those that do not act. A warning letter is the moment to fix the banner.
- **Sector sweeps.** Media, care and welfare, and insurance were named, so organisations in those sectors are more likely to be checked.
- **Same idea in court.** A German appeal court barred a banner with no first-layer reject option; compare [WetterOnline](/enforcement/wetteronline).

Related issue page: [Unequal choices or identity checks](/enforcement/issues/unequal-choices-or-identity-checks).

## How Inth catches this

- **Consent banner:** can show accept and reject in the first layer with equal prominence, and records which option the visitor chose.
- **Website audit:** captures the first-layer banner as displayed, by region and device, and flags a layer that offers accept without a visible reject control.
- **Evidence:** screenshots of the first layer, consent records with choice, country and banner version, and the trackers that loaded after each choice.

Limit: whether a given button design is "directly visible" is a judgement for the regulator; Inth records what was shown.

## Checks for your own systems

### In the repository

- Find the banner configuration and confirm the first layer has a reject action, not only accept and settings.
- Check the reject action is not hidden behind a scroll, a collapsed section or a text link styled as body copy.

### In the browser and network

- Open the site in a clean profile from the Netherlands on mobile and desktop and count clicks to refuse.
- After refusing, confirm no tracking requests are sent.

### With the people responsible

- Ask whether anyone received an AP warning letter and what was changed in response.
- Agree who signs off on banner design changes.

## Sources and limits

- [AP: AP onderzoekt websites vanwege misleidende cookiebanner](https://www.autoriteitpersoonsgegevens.nl/actueel/ap-onderzoekt-websites-vanwege-misleidende-cookiebanner), 16 October 2026 (Dutch)

The announcement does not name the two organisations, give their sector or cite a legal article. The 11 November 2025 release it links to was not reviewed in detail. Translations from Dutch are ours.

Source review: 20 October 2026. This page describes the cited announcement and procedural stage. It does not audit any organisation's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [WetterOnline](/enforcement/wetteronline), [Unequal choices or identity checks](/enforcement/issues/unequal-choices-or-identity-checks), [GDPR and ePrivacy cookies](/enforcement/laws/gdpr-and-eprivacy-cookies).