Cookie consent done right: what the law requires and what it costs

en 2026-09-16 6 min read

Proper cookie consent does not carry its own price tag: it is scoped into the fixed quote for your build, from EUR 600-900 for a single-page landing upward. The legal core is short: nothing that is not strictly necessary may be stored on or read from a visitor's device until they agree, and refusing has to be as easy as accepting.

Everything beyond that core is either careful engineering or theatre. We are a design and engineering studio, not a law firm, so read this as a builder's view of the rules and take specific legal questions to an adviser.

What the law actually requires

The ePrivacy rules, in the Netherlands the Telecommunicatiewet, require consent before anything non-essential is stored on or read from a device: cookies, local storage, pixels and fingerprinting alike. The GDPR then defines what valid consent is. Together that means:

• Before, not after. Non-essential scripts wait for a yes. A banner shown on top of tracking that already fired is decoration.
• A real choice. Accept and refuse are equally easy to find and use. Pre-ticked boxes and "by continuing to browse you agree" are not consent.
• Informed. Each category says what it is for and who receives the data, in plain language.
• Easy to withdraw. A cookie settings link stays reachable on every page.
• Provable. You can show what a visitor agreed to and when.

Strictly necessary storage needs no consent at all: a login session, a basket, the security tokens that protect your forms, and the cookie that remembers the consent choice itself.

What is theatre

• The banner that loads everything anyway. Analytics, pixels and chat widgets fire on page load and the banner only records a click. The network tab in your browser shows it on a fresh visit.
• Accept in colour, refuse in grey. A bright accept button with refusal hidden behind "settings" is the pattern European regulators have singled out. The Dutch regulator, the Autoriteit Persoonsgegevens, says it checks websites for misleading banners.
• The cookie wall. Blocking the site until someone accepts tracking does not produce freely given consent under European guidance.
• The template policy. A cookie list that names tools you never installed, and misses the ones you did, tells visitors nothing true.
• A banner with nothing behind it. If the site only uses strictly necessary storage, the banner asks a question with no legal purpose.

What doing it properly involves

1. Inventory. Every script, cookie, storage key, embed and pixel, including the ones arriving through a tag manager or a third-party widget.
2. Classify. Necessary, preferences, analytics or marketing, each with its purpose and provider.
3. Block by default. Nothing non-essential loads before its category is accepted, and video and map embeds get click-to-load placeholders.
4. Design the banner. Accept, refuse and settings on the first layer, with equal weight, readable on a phone.
5. Wire the signals. If you advertise with Google, the choice has to reach Consent Mode, which Google requires for its advertising features to keep working for visitors in Europe.
6. Test. In a clean browser, check the network requests before any click, after refusing and after accepting. Refusing should leave nothing non-essential behind.

What moves the price

Consent work grows with the number of outside tools your site talks to, not with its page count. Every analytics tool, ad pixel, booking widget, chat bubble or video embed is one more thing to classify, block and test.

A paid consent platform brings scanning, translations and consent logs for a subscription. A lighter layer built into the site has no subscription and less script weight, but needs updating whenever you add a tool. Which one fits is settled during scoping, and a fixed quote follows. For an existing site, scoping starts with a scan of what it loads today. Every step is on the packages page.

Process and timeline

Consent is built in, not pasted on, so it follows the timeline of your step: 1-2 weeks for a single-page landing, 2-3 weeks for a mini-site, 3-6 weeks for a business website and 6-12 weeks for an advanced site or web app. It comes up at four points.

1. Scoping. The tools you use now and the ones you plan to add, because each one changes the setup.
2. Design. The banner and settings panel are designed with the rest of the site, in your type and colours, as part of our design engineering work.
3. Build. Scripts gated by category, embeds behind placeholders, and the choice stored and reopenable from every page.
4. Launch check. Clean-browser network tests, plus the cookie and script inventory your privacy policy needs. The legal wording of that policy is for you or your adviser, and this is the part that waits on you.

After launch, Care at EUR 100-300/mo covers updates, monitoring, backups and small fixes. Adding a new tool with its own tracking is a change to the site, and its consent category belongs to that change.

When to spend less

• Drop what you do not read. An ad pixel or heatmap tool nobody opens still carries a consent burden. The cheapest compliant script is the one you never load.
• Use analytics that store nothing. Analytics that set no cookies and do not fingerprint visitors may need no prompt, depending on configuration, and Dutch law exempts analytics with little or no privacy impact under strict conditions. Without advertising, that can mean no banner at all.
• Skip the enterprise platform. A mini-site with a contact form does not need a consent subscription built for multinational shops.
• Do not buy a banner for its own sake. If the inventory shows only strictly necessary storage, a clear privacy page does the job.

Frequently asked questions

Do I need a cookie banner if I only use Google Analytics?

Standard Google Analytics sets cookies and sends data to Google, so in the EU assume it needs consent. A privacy-friendly configuration can reduce that obligation in some countries, under strict conditions that regulators keep revising. If analytics is your only non-essential tool, a cookieless alternative can remove the question.

Is a free cookie plugin enough?

A plugin shows a banner, but it only blocks what is connected to it. Tags added later through a theme, a tag manager or a widget can load around it. Check the network tab on a fresh visit before trusting any banner, free or paid.

Can we block the site until people accept?

European data protection guidance says consent given to get past a cookie wall is not freely given, and the Dutch regulator takes the same view. You can explain why you ask and make accepting easy, but refusing has to leave the site usable.

Does this apply if my business is outside the EU?

If your site is aimed at people in the EU, for example with prices in euros, a European language or delivery to EU addresses, plan as if the rules apply. The UK has its own rules built on the same pattern, so a setup built to the EU standard covers the common ground.

Who owns the consent setup after launch?

You do. The client owns the code, the repository and the database, and the consent layer is part of that code. Hosting is agreed per project, and ownership of the code does not depend on it.

If you want consent built into your next site rather than pasted on top of it, tell us what the site needs to do.