Cookies, integrations and consent

Module 7: Privacy and rules · Reading time: 11 minutes

Learning objective: After this lesson you can explain when you need consent for cookies and tracking code, set up the cookie banner of your AI Builder site, connect analytics services so they only load after consent, and use your browser to check that nothing is measured before a visitor makes a choice.

Key concepts: cookie, terminal equipment, consent, necessary cookies, limited analytical cookies, tracking cookies, cookie banner, integration, measurement ID, custom code, Cookie settings

This lesson explains the rules as they apply on 10 November 2026. It is not legal advice. If you are unsure about your situation, ask a lawyer or your trade association.

What the rule says

A cookie is a small file that a website places in the visitor's browser. The rule also applies to other storage in the browser, and to pixels and scripts that recognise a device.

In the EU, the basis is the ePrivacy Directive (2002/58/EC), Article 5(3): storing information on a user's device, or reading information from it, is only allowed if that user received clear and complete information and gave consent. There is an exception for what is technically needed to carry out the communication, or strictly necessary for the service the visitor asks for.

Every EU country has put that rule into its own law, and each country has its own regulator. In the Netherlands it is the Dutch cookie rule, Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet). The Netherlands adds an extra exception: cookies that collect information about the quality or effectiveness of your site also need no consent, provided they have no or minor consequences for privacy. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) calls these limited analytical cookies: counting visitors and popular pages, without following visitors across sites or building profiles. Keep two things in mind:

• Even without a consent requirement, you often process personal data (an IP address). Then the GDPR applies: you need a legal basis and you mention it in your privacy statement (lesson 7.1).
• Other countries are sometimes stricter; if you have many visitors from abroad, check what the regulator there says.

Tracking cookies and anything that follows visitors, builds profiles or is used for advertising always need consent in advance. That consent must be free and specific: doing nothing or clicking on is not consent. The AP gives four rules of thumb for a clear banner: say what you use cookies for, make declining as easy as accepting, make changing a choice later just as easy, and keep consent and objection separate.

How the AI Builder handles it

The builder sorts everything from other parties that runs on your site into four types, with the explanation your visitors also see:

If anything runs that is not Necessary, the builder turns the cookie banner on automatically. In the settings you then see Cookie banner is on automatically, with the services that require it, and the switch cannot be turned off while those services run. Everything outside Necessary only loads once the visitor gives consent for that type:

• An integration (such as Google Analytics) sits in the page as a script that does not run. Only after consent for Statistics does the site switch it on.
• A widget (map, appointment planner, video) first shows a box with "This block comes from Google Maps and only loads once you allow Functional." and an Allow and show button. A YouTube video uses the version without cookies until it plays; it also waits for consent.
• If a visitor withdraws consent, the site deletes the known cookies of that type. If a service is added later, the banner asks again.

At the bottom of every page there is then a Cookie settings button, which visitors can use to change their choice at any time.

Settings > Cookies and consent

At the top you see the status: which services run and in which type. Below that you set:

• Show cookie banner: on or off. If nothing from another party runs, the builder says "No third-party cookies" and a banner is not required.
• Display: Bar at the bottom or Card bottom right. You see the banner straight away in the preview.
• Visitor may choose per type: on gives the visitor Choose what you allow next to Accept all and Only necessary. Off shows only the two buttons. If you use services in more than one type (a map and Google Analytics), turn this on: the AP asks for a choice per purpose.
• Banner text: empty means the standard text. If you write your own text, say clearly what you use cookies for.
• Accept button and Decline button: the text on the buttons. Keep the decline button clear. "Only necessary" or "Reject" is fine; "Later" or "Maybe" is not, because then the visitor does not know what they are choosing.
• Privacy page: the page that More about privacy links to (lesson 7.1).

A pitfall with the layout: in the banner, the accept button has the style of a main button and the decline button a quieter style. Check on your phone and your computer that the decline button is just as easy to see and tap. If it is not, put a clear text on the button.

Settings > Integrations

Under Integrations you only enter the number or code you get from the service; the builder adds the rest. The list is divided into three groups: Statistics, Without cookies and Marketing and advertising.

You can also connect LinkedIn Insight Tag, Hotjar and Microsoft Clarity. After Connect the builder shows "This service places cookies, so the cookie banner is now on." On the free address, Google Analytics 4, Google Ads, the Meta-pixel, LinkedIn, Clarity and Plausible work; Google Tag Manager, Hotjar and custom code only come with a site on a package.

Why is Plausible under Necessary? Plausible measures without cookies and without storing anything on the device, so the cookie rule does not apply and the builder loads it without a banner. The GDPR still applies: mention it in your privacy statement. The builder always treats Google Analytics 4 as Statistics with consent, even though it shortens the IP address. That is the safe choice: whether Analytics can run without consent depends on many settings.

Three pitfalls:

1. Pasting tracking code into the chat or a widget. The builder then refers you to Settings, Integrations: only there does the banner know about it.
2. Setting custom code to necessary. At the bottom of Integrations you find Custom code. The banner blocks scripts from known services there. With the This code is necessary switch, the code loads straight away, even without consent. Only choose that for code your site needs and that tracks nobody. If the builder reports addresses it does not recognise, do not set it to necessary.
3. Tag Manager as a box. The builder only loads the container after consent for Marketing, but it cannot see what is inside. You are responsible for every tag in it.

Testing it yourself

Check it after every new integration, and update your privacy statement too (lesson 7.1):

1. Open your real site (not the preview in the builder) in a private window.
2. Open your browser's developer tools (often F12) and choose the Network tab. Reload the page.
3. Look for requests to services such as google-analytics.com, googletagmanager.com or facebook.net. Before your choice, none should appear.
4. Click Accept all and look again: now they appear.
5. Click Cookie settings at the bottom, choose Only necessary and check in the tab with your site's storage and cookies (Application in Chrome, Storage in Firefox) that the _ga cookies are gone.

Summary

• The ePrivacy Directive (in the Netherlands Article 11.7a of the Dutch Telecommunications Act) requires consent for cookies and similar techniques, except for what is strictly necessary; the Netherlands also exempts limited analytical cookies.
• Declining must be as easy as accepting, and so must changing a choice later.
• The AI Builder turns the banner on automatically as soon as something needs consent, and only loads integrations, widgets and videos after consent for their type.
• Enter analytics services under Settings > Integrations, not in the chat or a widget; only set custom code to necessary if it tracks nobody.
• After every new integration, test in a private window with the Network tab.

Quiz

Exercise

Exercise A7.2: No tracking code without consent. If you like, connect an analytics service via Settings > Integrations, publish your site again and enter the web address of your AI Builder site. The program opens your pages like a new visitor who has not chosen anything yet, without cookies and without running JavaScript. It checks whether a tracking or advertising script (such as Google Analytics, Tag Manager, Google Ads or the Meta-pixel) loads straight away instead of waiting for consent, whether cookies from such services are set, and whether there is a cookie banner on the page if your site uses services from other parties. If you use no services from others, or only Plausible, that is fine too.

Further reading

• Rules of thumb for clear cookie banners (Dutch Data Protection Authority, Dutch source): https://autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies/vuistregels-heldere-cookiebanners
• Cookies (Dutch Data Protection Authority, Dutch source): https://autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies
• Measuring visitors without a cookie banner
• Dutch Telecommunications Act, Article 11.7a (wetten.overheid.nl, Dutch source): https://wetten.overheid.nl/BWBR0009950/
• Free course Getting found online 8.1: Measuring with privacy-friendly analytics