Cookie banners and GDPR in 2026: what a Belgian website actually has to do

Cookies strictly necessary for the site to work, such as a basket session or a language preference, need no consent. The banner becomes mandatory as soon as a cookie or tracker serves another purpose: third-party analytics, advertising, embedded videos, share buttons.

A brochure site with no third-party analytics, no embedded YouTube video and no ad pixel can legally do without a banner. It is the simplest case, and more common than people think.

The typical breaches: cookies set before the user chooses, a reject button missing or hidden behind a link, pre-ticked boxes, and no way to withdraw consent as easily as it was given.

The Belgian authority has already fined sites for a banner where refusing was less visible than accepting. The principle is simple: accepting and refusing must take the same effort.

Two buttons of equal weight at the first level, accept and reject, plus access to settings by purpose. Nothing is set before the click. A permanent footer link allows changing the choice. The text says what is collected, by whom and why.

The banner must not block reading the page or slow its loading. Solutions that load a heavy third-party script before even showing content create a performance problem on top of the legal one.

Privacy-friendly analytics tools, with no cookie or individual identifier, show page views and traffic sources without a banner. They give less detail than Google Analytics, but enough for most small businesses.

For advertising campaigns, consent remains unavoidable. You then have to accept that some visitors refuse and that the figures are partial.

GDPR also covers forms, newsletters and customer accounts: clear information at collection, a precise purpose, a retention period, and a privacy policy describing what the site really does, not a copied template.

A simple record of processing and a contract with each processor, host included, complete the setup. For a small business it fits on a few pages.