Changes to this website
The Autoriteit Persoonsgegevens (the Dutch data protection authority or AP) endeavours to provide up-to-date and reliable information on this website. Sometimes, this means we have to amend information. This might be due to new developments, changes in legislation, new insights or court rulings. This page provides an overview of the most important changes on this website from April of 2025 onwards.
If we have made a (major) change to a web page, the date on which the page was last updated is shown at the bottom of that page. You will also see a note indicating where the text has been changed. If you wish to see the old text, please visit our online archive.
On this page
Automated decision-making (May 2025)
A new page about automated decisions (automated decision-making) has been added to this website.
Legitimate interest (April 2025)
The interpretation of the legal basis of legitimate interest used by the AP is incorrect. This became apparent after a ruling by the European Court of Justice.
In the AP's interpretation, simply having a purely commercial interest did not in itself qualify as a 'legitimate interest'. However, according to the Court, this can qualify as a legitimate interest and the AP's interpretation was too strict.
As such, the first requirement for a successful appeal on the legal basis of legitimate interest can be met sooner than the AP initially believed. This means this legal basis can be applied more widely. The Court does emphasise that there are two other requirements for this legal basis.
The following pages and documents on the AP website have been changed accordingly:
- Legal basis of legitimate interest
- Legal bases for WiFi tracking and Bluetooth tracking
- Clear cookie banners
- Advertising mail
- Guidelines for scraping by private individuals and private organisations (in Dutch)
Cookies (april 2025)
The AP has amended two pages about cookies. The changes for each page are listed below. Furthermore, some pages have been merged because of overlapping content.
Page: Clear cookie banners
Subject: informing about processing purpose via cookie banners
The AP has amended the explanation of how cookie banners should provide information about the purposes of processing. The old rule of thumb for informing via a cookie banner about the purposes of tracking cookies and similar techniques was incomplete and not sufficiently in line with the EDPB guidelines on consent. The amended text acknowledges that you can present information on a cookie banner in different layers and clarifies which data should be put in the first layer at minimum.
Subject: Withdrawal of consent
The AP has adjusted the text under "Be clear about the withdrawal of consent". The new text recognises that sometimes, it is appropriate to use wording other than "withdrawing consent". The text now also better aligns with the AP's interpretation of the standard (in Dutch) regarding the withdrawal of consent for cookie banners.
Subject: Do not confuse consent with legitimate interest
The AP has amended the text under 'Do not confuse consent with legitimate interest'. The AP now explicitly states that a single legal basis must be selected for processing personal data. This follows from the GDPR's systematics.
Page: Cookies
Subject: limited analytics cookies
The AP has amended the text regarding consent for limited analytics cookies. This amendment is in line with the Telecommunications Act. The new text states that a valid legal basis is required whenever limited analytics cookies process personal data. The previous text stated that consent is required for this.