Your cookie banner is a promise. Do you keep it?

Anyone who clicks reject in a cookie banner expects the website to stop keeping track of them afterwards. Websites promise as much, although it often happens anyway. That was the common thread when PRIVAN founder Pim Kitzen joined Axel Hommenga on the Recruitment Experiments podcast.

The episode was about avoiding fines, which Axel himself admitted isn’t the sexiest subject. The Dutch regulator is checking websites more and more often, and recruitment websites run an extra risk because they tend to run more tracking than average, although most of what Pim said applies to any website.

\ 01Mistakes creep in over time

Many organisations treat tracking and privacy compliance as a job you do properly once, after which it would stay in order by itself. “So much happens on and around a website that can suddenly put your tracking or your compliance out of order,” says Pim.

Often it’s a pixel or script that was added later, by an agency for example, or an update to the cookie banner itself. Behind it there’s usually a small configuration mistake, or something someone overlooked.

\ 02Why recruitment websites run an extra risk

In recruitment, tracking carries more weight than it does for the average web shop. A candidate is worth a lot and the target group is small, because you are after a specific profile and there simply aren’t hundreds of thousands of those around.

So you want to know exactly what a campaign delivers, per channel and per profile, from the first job view to the application. You measure that with analytics and marketing pixels, and your ATS often adds pixels of its own.

Hooking all this up is quick. A tool asks you to ‘just add this little script’ to your job pages and your thank-you page, and that’s it. “It all works, until at some later point one of those new pixels gets added,” Pim explains. That pixel then sets cookies or shares data with a third party, while nobody gave consent for it in the cookie banner.

\ 03The regulator is checking automatically

For a long time, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) mainly looked at websites when a complaint came in. Since April 2025 the AP has also been scanning 10,000 Dutch websites continuously and automatically, with the aim of warning 500 organisations a year.

The AP doesn’t say which websites receive a letter. Smaller organisations are among them too, and at the start more than half of those websites appeared to break the law, according to the AP.

If the AP finds something, you get a letter explaining what is wrong, and then three months to fix it. If it still isn’t in order after that, an investigation follows and a fine becomes a real possibility. By November 2025 the AP had warned more than 200 websites. About three quarters adjusted their cookie banner, and the AP has started enforcement action against the rest.

Fines and letters from the AP

Under the GDPR, fines can reach €20 million or 4% of worldwide annual turnover. The well-known Dutch cookie fines were lower (Kruidvat was fined €600,000, Coolblue €40,000), and “the number of fines is still fairly limited,” says Pim.

A letter is more likely, and it can land at any moment. Other plans then have to wait while you suddenly sit down with your lawyer, plus the developer or agency that runs your website or careers site. The letter tells you what is wrong, but working out how to fix it technically is largely up to you, and meanwhile the three months keep running.

Regardless of the AP, you also simply want to do right by your visitors and candidates, and nobody wants to make the news because data was quietly being shared with other parties.

\ 04What happens when someone rejects

Because there is a cookie banner on the site, many organisations assume they’re fine. It went up at some point and was then ticked off the list. “But a cookie banner is really nothing more than a promise,” says Pim. Visitors rely on that promise, and website owners often do too.

If you check what really happens when someone rejects or ignores the banner, the result is regularly disappointing. “I click no, but it still means yes,” is how Pim puts it. The tracking loads anyway. Every page view goes to Meta or LinkedIn together with the IP address, and cookies with a unique ID are set.

When people think of tracking, the pixels from Meta, Google Ads or LinkedIn usually come to mind first. Yet parts that look harmless pass on data too, such as a YouTube video on your job page or fonts loaded from Google’s servers. An embedded application form or a jobs widget can do the same, even though it looks like ordinary functionality.

\ 05Consent rates and your campaign numbers

Tracking and compliance go together fine, Pim thinks, as long as you know what is and isn’t allowed and your banner does what it promises. Still, there’s a fear that you’ll lose data if you set things up properly, and that your campaigns will perform worse as a result.

How many visitors give consent varies a lot by sector. According to Pim, usually more than half accept and sometimes as many as 80 to 90 percent, although on some websites the share is considerably lower. For any given website the rate tends to stay fairly stable, so once you know it, you can correct your numbers for it.

Then there are the applications coming into your ATS, and those are what you adjust your bids per channel on. Axel recognised this. In the end you steer on trends, he said, and the hard data sits in your own systems.

Measuring without consent

Google Analytics wasn’t exactly built with privacy first. There are good alternatives you can configure so that no consent is needed, and that is how we measure on privan.com too. It only works if the data stays in your own environment and can’t be traced back to a person, so check carefully that it really is set up that way.

For marketing tracking, from Meta or LinkedIn for example, you do ask for consent, because under the GDPR you need a legal basis to share personal data and tracking IDs with parties like these. Pim calls that combination “a really good foundation”.

\ 06How to fix it

In most cases fixing it is manageable, because “it very often goes wrong in the details,” says Pim. It won’t take you months, although you do need to go past a few people, and how far you go is up to you.

The agency that manages your tag manager may have to change something, or your developer removes a pixel or configures the banner differently, but it can also be as small as a single setting in a marketing tool.

1. Cookies only after consent

This is where it goes wrong most often. Cookies should only be set once a visitor has given consent, so if someone rejects, they stay off.

2. Share nothing after a rejection

Many tools now have a cookieless mode, but even then they often still pass on which pages someone views, together with the IP address. Whether that is allowed is doubtful, especially if the party is based outside Europe. So after a rejection, block the outgoing requests to third parties as well.

3. Check functional elements too

That leaves the parts that seem functional, like the videos and fonts mentioned above. For each one, find out who you share data with and what exactly gets shared. Is there a legal basis for it? Where needed, replace it with something that doesn’t give away visitor data, such as fonts you host yourself or a video player that only loads anything once someone presses play.

\ 07Where do you stand?

Start by finding out what your website does today. “Very often, companies genuinely have no idea where they stand right now,” says Pim. Because a website keeps changing, it pays to keep an eye on it continuously. Then you spot a deviation before the regulator does and can sort it out calmly.

If you want to know where your website stands, run the free risk analysis. You don’t need an account and there is nothing to install. Among other things, you see what is set before consent and whether your banner really blocks.