Skip to main content
Get Started
Open menu Close menu

Denmark

Cookie and privacy rules

Danish cookie rules: Consent, rejection and documentation

Running a website in Denmark? Under the Danish Cookie Order, you need informed consent before storing or reading information on a visitor’s device, unless an exemption applies. This guide covers what that means for your banner, your tracking and the documentation behind it.

At a glance

Who it can apply to
Danish websites and apps that store or read information on visitors’ devices, including through embedded third-party tools.
What it is
The Danish Cookie Order (BEK nr. 1148 of December 9, 2011), which implements Article 5(3) of the ePrivacy Directive. GDPR applies alongside it to personal data.
Choices to offer
Opt-in consent for each optional purpose, a rejection option as easy as acceptance and withdrawal at any time. Technically necessary storage or access is exempt.
Website actions
  • Hold back non-necessary tracking until consent.
  • Show accept and reject options in the first layer.
  • Let visitors choose purposes separately and withdraw easily.
  • Keep screenshots of each banner version as documentation.
  • Plan renewal: yearly is often appropriate, not a legal deadline.
Last reviewed

Does this apply to your website?

The Cookie Order applies to Danish websites and apps, including webshops and business websites. According to the joint guidance, you are responsible for every technology on your service, including third-party tools, even when a supplier handles the setup.

Start with an inventory: analytics, advertising pixels, video players, maps, fonts, chat widgets and booking forms. Check what each tool actually does rather than assuming every tool in a category behaves the same way.

The rules are technology-neutral. Datatilsynet explains that pixels, fingerprinting and device identifiers can also be covered, so removing traditional cookies does not remove your obligations.

Think of these as two checks. The Cookie Order covers storing or reading information on a device, whatever that information is; GDPR covers personal data, including what happens after collection. Both often apply to the same tool, so the two Danish authorities have published joint guidance.

Digitaliseringsstyrelsen supervises the Cookie Order, and breaches can be fined. Datatilsynet supervises GDPR, which still requires a lawful basis and clear privacy information after consent is collected. Our GDPR and cookies guide covers that layer.

1. Separate necessary functions from optional tracking

The Cookie Order’s exemptions cover transmitting a communication and storage or access technically required for a service the visitor expressly requested, such as login, a shopping basket or a chosen language. A campaign-measurement cookie does not become necessary because it is useful to you, and a plugin that also tracks does not belong in “Necessary”.

2. Make rejecting as easy as accepting

Offer clear accept and reject options in the first layer, for example “Accept all”, “Reject optional cookies” and “Choose settings” (examples, not mandatory wording). The joint guidance says refusing must be as visible as accepting, and warns that colors, low contrast and repeated prompts can make consent invalid. Test on mobile as well as desktop.

3. Ask for each purpose separately

Let visitors accept statistics without accepting marketing: the joint guidance treats one bundled consent for several purposes as not freely given. Pre-ticked boxes, switches already set to on and continued browsing do not count, and the EDPB rejects scrolling too. Name purposes plainly: “Measure how visitors use our website” says more than “Third-party technologies”.

4. Give visitors the information they need

According to the joint guidance, the first layer should name you and any partners, the purposes, the types of data, any sharing with third parties and the right to withdraw. Details such as each technology’s provider, purpose and expiry can sit one click away. Update the information whenever your tools change.

5. Make withdrawal as easy as consent

Withdrawing must be as easy as consenting, at any time and free of charge, for example through a link on every page or a fixed icon that reopens the settings. Check that withdrawal changes what runs, not just the switches in the banner, and how each tool handles cookies already stored.

What this means for analytics and marketing

Imagine a webshop with a basket cookie, analytics and advertising tracking. A visitor chooses statistics but rejects marketing. Your setup should reflect that combination rather than treating any click on the banner as permission for every tool.

“Only for our own statistics” is not an exemption: Digitaliseringsstyrelsen’s website-statistics example and the joint guidance both say statistics cookies require consent. The authority has said it does not prioritize supervising simple statistics that meet strict criteria, but that is an enforcement priority, not a legal exemption, and GDPR still applies.

If measured conversions change after a banner update, check whether data collection changed before concluding that campaigns did. Keep a log of banner and tracking changes, and compare reporting with completed orders.

Website testing checklist

The most common problems Digitaliseringsstyrelsen reports are tracking that starts before the visitor can consent, unclassified tracking technologies and missing cookie banners. Test each scenario from a fresh session with previous consent cleared, and check actual cookies and requests as well as the banner.

  • Before a choice: no non-necessary cookies or tracking requests have started.
  • Reject optional cookies: after a reload and a visit to another page, the choice is still respected.
  • Accept statistics only: analytics starts while marketing stays off.
  • Accept all: the intended tools start and the choice is saved.
  • Withdraw consent: after reopening the settings and changing the choice, the affected tracking stops.
  • Pages and devices: product pages, checkout, campaign landing pages and pages with embedded content behave the same on mobile and desktop.
  • Classification and information: every detected cookie or tracker has a purpose and category, and the listed providers match the tools actually running.

Save the test date, results and fixes, and repeat after adding tools or changing the website. This is a recommended routine, not a statutory testing schedule.

Renewal and documentation

Short answers: neither the Cookie Order nor GDPR sets a fixed deadline for renewing consent. The joint guidance says renewing it once a year, and asking again once a year after a refusal, will often be appropriate. It also says you must be able to document consent for as long as you process the visitor’s information, without collecting extra personal data to do so.

Renewal. The joint guidance asks you to weigh the purpose, how intrusive the processing is and visitors’ expectations when you set the interval. A new purpose, such as marketing instead of statistics, needs new consent before you start. Showing the banner on every visit to people who have already chosen is too often. In Passiro, you set the period under Consent Validity.

Documentation. The guidance accepts system documentation: be ready to show your consent procedure, including what visitors saw, and that it met the conditions for valid consent. Keep dated screenshots of each banner version and its settings, plus a short assessment where your approach is not obvious. Records of individual choices can support this but do not replace a record of what the banner showed.

FAQ

Do I need a banner if I only use strictly necessary cookies?

You do not need consent for uses within the Cookie Order’s exemptions, but check the actual setup first. The joint guidance notes, for example, that third-party fonts only count as necessary if the provider uses the information solely to deliver them, not to track visitors.

Are first-party cookies exempt?

No. A cookie’s purpose matters more than whether it comes from your own domain. The Cookie Order has no blanket exemption for first-party cookies.

Does my cookie banner need to be in Danish?

Use language visitors can understand. The joint guidance says a Danish-language website or app should also provide its consent solution and privacy information in Danish.

What about videos, maps and other embedded content?

Many embeds set cookies or send data as soon as they load. Hold them back until the visitor consents, for example behind a placeholder that explains what loading the content involves. As Digitaliseringsstyrelsen makes clear, you remain responsible even when the provider sets the cookies.

Can I require visitors to accept tracking to access the website?

Only with a genuine alternative. A cookie wall that leaves no other way in does not give a free choice. Where payment is the alternative, Datatilsynet looks at whether it is equivalent and reasonably priced, and whether consent and processing are limited to what is needed.

Do the rules apply to apps?

Yes. The Cookie Order is technology-neutral and covers apps as well as websites. Digitaliseringsstyrelsen has announced supervision focused on the most-used Danish apps.

Explore Passiro’s consent tools