Short answer
Non-essential trackers must wait for valid consent
The Belgian Data Protection Authority requires prior consent for cookies that are not strictly necessary, a genuine choice, refusal as accessible as acceptance and easy withdrawal. Necessary cookies may operate without consent, but they must genuinely be necessary.
What a cookie banner must do in practice
- Before any choice: load only what is strictly necessary for the requested service.
- At the first level: explain purposes and offer accept/reject without artificially steering the user.
- By purpose: provide granular choices when several uses exist.
- After the choice: keep useful evidence, honour refusal and make withdrawal easy.
A cookie name is not the only evidence. Network requests, browser storage, scripts and embedded components must be observed.
A real fine is not a universal price list
The Belgian DPA fined Roularta €50,000 in a case covering several news websites and specific cookie failures. It is a real decision that shows how rules are applied, not the “standard invoice” for a small website.
Depending on the case, other outcomes include remediation orders, processing restrictions and GDPR sanctions. Severity, duration, number of people, cooperation and corrective action are among the factors assessed.
Hebora’s cookie audit, evidence by evidence
- Zero state. Fresh browser, no choice: capture network requests, cookies, local storage and scripts.
- Three journeys. Accept, reject, then withdraw; desktop and mobile.
- Source of every tracker. CMS, tag manager, video, map, chat, payment, analytics or advertising.
- Correction. Prior blocking, purpose-based activation, removal where possible and a permanent preferences link.
- Delivery. Before/after table, network captures, supplier list and factual copy for the DPO or lawyer.
A website with no non-essential tracker does not need to invent a banner. Removing a needless tool can be better than adding a consent layer.
Verified official sources
- Belgian Data Protection Authority — cookies and other trackers (official guidance in French)
- Belgian Data Protection Authority — Roularta cookie case, €50,000 fine (official source in French)
- EUR-Lex — General Data Protection Regulation (GDPR)
Sources checked on 15 August 2026.