{
  "schema_version": 1,
  "lang": "en",
  "page_type": "guide",
  "source_file": "banniere-cookies-rgpd-belgique-en.html",
  "context_url": "https://hebora.be/contexts/banniere-cookies-rgpd-belgique-en.en.json",
  "url": "https://hebora.be/banniere-cookies-rgpd-belgique-en.html",
  "title": "Cookie banner in Belgium: rules and audit | Hebora",
  "meta_description": "Cookie banner in Belgium: prior consent, refusal, withdrawal, evidence, fines and a technical audit of website trackers Check the practical steps.",
  "h1": "Cookie banner in Belgium: what must be blocked before consent",
  "lead_paragraph": "A polished banner is not enough. If Analytics, a pixel, a video or an advertising tool already sets a tracker before the choice, the real behaviour contradicts the interface.",
  "structured_data_types": [
    "Article",
    "Organization",
    "ImageObject",
    "GovernmentOrganization",
    "WebPage",
    "CreativeWork",
    "BreadcrumbList",
    "ListItem"
  ],
  "entities_mentioned": [
    {
      "name": "Hebora",
      "type": "Organization"
    },
    {
      "name": "Belgian Data Protection Authority",
      "type": "GovernmentOrganization"
    },
    {
      "name": "Roularta Media Group",
      "type": "Organization"
    },
    {
      "name": "European Union",
      "type": "Organization"
    }
  ],
  "headings": [
    {
      "level": 2,
      "text": "Non-essential trackers must wait for valid consent"
    },
    {
      "level": 2,
      "text": "What a cookie banner must do in practice"
    },
    {
      "level": 2,
      "text": "A real fine is not a universal price list"
    },
    {
      "level": 2,
      "text": "Hebora’s cookie audit, evidence by evidence"
    },
    {
      "level": 2,
      "text": "Verified official sources"
    },
    {
      "level": 2,
      "text": "Test my banner before publication"
    },
    {
      "level": 2,
      "text": "Continue the review"
    },
    {
      "level": 3,
      "text": "AI-built website: what still needs checking in Belgium"
    },
    {
      "level": 3,
      "text": "Lovable Cloud and GDPR: who is responsible for what in Belgium?"
    },
    {
      "level": 3,
      "text": "AI chatbot on a Belgian website: what must you disclose and check since 2 August 2026?"
    }
  ],
  "sections": [
    {
      "heading": "Non-essential trackers must wait for valid consent",
      "intro": "The Belgian Data Protection Authority requires prior consent for cookies that are not strictly necessary, a genuine choice, refusal as accessible as acceptance and easy withdrawal. Necessary cookies may operate without consent, but they must genuinely be necessary."
    },
    {
      "heading": "What a cookie banner must do in practice",
      "intro": "A cookie name is not the only evidence. Network requests, browser storage, scripts and embedded components must be observed."
    },
    {
      "heading": "A real fine is not a universal price list",
      "intro": "The Belgian DPA fined Roularta €50,000 in a case covering several news websites and specific cookie failures. It is a real decision that shows how rules are applied, not the “standard invoice” for a small website."
    },
    {
      "heading": "Hebora’s cookie audit, evidence by evidence",
      "intro": "A website with no non-essential tracker does not need to invent a banner. Removing a needless tool can be better than adding a consent layer."
    },
    {
      "heading": "Verified official sources",
      "intro": "Sources checked on 15 August 2026."
    },
    {
      "heading": "Test my banner before publication",
      "intro": "Hebora captures network activity before a choice, after refusal and after withdrawal on mobile and desktop, then corrects actual tracker loading."
    },
    {
      "heading": "Continue the review",
      "intro": "The website owner must still check business disclosures, legal grounds, notices to individuals, cookies, security, supplier contracts and — when applicable — e-commerce and accessibility rules. The platform helps build; it does not make those decisions for you."
    }
  ],
  "proof_points": [
    {
      "label": "No non-essential tracker should leave the device.",
      "value": "Before choice"
    },
    {
      "label": "Reject must be as accessible as accept.",
      "value": "Same level"
    },
    {
      "label": "Changing one’s mind cannot become a hidden journey.",
      "value": "Easy withdrawal"
    },
    {
      "label": "Actual fine in the Roularta media case; not an automatic rate for every SME.",
      "value": "€50,000"
    }
  ],
  "internal_links": [
    {
      "label": "Home",
      "url": "https://hebora.be/en.html"
    },
    {
      "label": "SEO & GEO in Belgium",
      "url": "https://hebora.be/seo-bruxelles-en.html"
    },
    {
      "label": "Test my trackers",
      "url": "https://hebora.be/diagnostic-en.html"
    },
    {
      "label": "AI-built website: what still needs checking in Belgium The website owner must still check business disclosures, legal grounds, notices to individuals, cookies, security, supplier contracts and — when applicable — e-commerce and accessibility rules. The platform helps build; it does not make those decisions for you.",
      "url": "https://hebora.be/conformite-site-ia-belgique-en.html"
    },
    {
      "label": "Lovable Cloud and GDPR: who is responsible for what in Belgium? Lovable’s DPA generally describes the customer as controller and Lovable as processor for data handled on the customer’s behalf. The customer still configures the app, informs users, chooses data and integrations, and handles requests to exercise data rights.",
      "url": "https://hebora.be/lovable-cloud-rgpd-belgique-en.html"
    },
    {
      "label": "AI chatbot on a Belgian website: what must you disclose and check since 2 August 2026? Article 50 of the AI Act requires providers to design direct-interaction systems so people are informed that they are interacting with AI, unless that is obvious. The website owner must also check its own duties as deployer and data controller.",
      "url": "https://hebora.be/transparence-chatbot-ia-belgique-en.html"
    }
  ],
  "open_graph_image": "https://hebora.be/images/legal/consentement-cookies-belgique-og.png",
  "images": [
    {
      "src": "https://hebora.be/images/legal/consentement-cookies-belgique-1536.webp",
      "alt": "Shop owner and adviser testing cookie consent on a phone and laptop"
    }
  ],
  "answer_summary": "The Belgian Data Protection Authority requires prior consent for cookies that are not strictly necessary, a genuine choice, refusal as accessible as acceptance and easy withdrawal. Necessary cookies may operate without consent, but they must genuinely be necessary.",
  "services_provided": "Hebora captures network activity before a choice, after refusal and after withdrawal on mobile and desktop, then corrects actual tracker loading.",
  "source_urls": [
    "https://www.autoriteprotectiondonnees.be/professionnel/themes/internet/cookies",
    "https://www.autoriteprotectiondonnees.be/citoyen/enquete-cookies-sur-les-sites-de-presse-roularta-mis-a-lamende",
    "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  ],
  "last_verified": "2026-08-15",
  "legal_boundary": "Hebora performs technical audits and corrections. This content is not legal advice, does not certify compliance and does not replace a lawyer or DPO when your situation needs legal interpretation."
}