Cookie banner in Belgium: what must be blocked before consent

What a cookie banner must do in practice

• Before any choice: load only what is strictly necessary for the requested service.
• At the first level: explain purposes and offer accept/reject without artificially steering the user.
• By purpose: provide granular choices when several uses exist.
• After the choice: keep useful evidence, honour refusal and make withdrawal easy.

A cookie name is not the only evidence. Network requests, browser storage, scripts and embedded components must be observed.

A real fine is not a universal price list

The Belgian DPA fined Roularta €50,000 in a case covering several news websites and specific cookie failures. It is a real decision that shows how rules are applied, not the “standard invoice” for a small website.

Depending on the case, other outcomes include remediation orders, processing restrictions and GDPR sanctions. Severity, duration, number of people, cooperation and corrective action are among the factors assessed.

Hebora’s cookie audit, evidence by evidence

1. Zero state. Fresh browser, no choice: capture network requests, cookies, local storage and scripts.
2. Three journeys. Accept, reject, then withdraw; desktop and mobile.
3. Source of every tracker. CMS, tag manager, video, map, chat, payment, analytics or advertising.
4. Correction. Prior blocking, purpose-based activation, removal where possible and a permanent preferences link.
5. Delivery. Before/after table, network captures, supplier list and factual copy for the DPO or lawyer.

A website with no non-essential tracker does not need to invent a banner. Removing a needless tool can be better than adding a consent layer.