Danish Cookie Law: What your website needs to get right

The key takeaway: make the choice clear, apply it to your tracking and check that it works. A visible banner alone is not enough.

Does this apply to your website?

Digitaliseringsstyrelsen’s guidance covers Danish websites and apps, including webshops and business websites. Using an overseas plugin does not remove your responsibility for cookies placed through your Danish service.

Start with an inventory of the tools on your site: analytics, advertising pixels, video players, maps, chat widgets and booking forms. Identify their actual behaviour rather than assuming that every tool in a category works the same way.

The rules are technology-neutral. Datatilsynet explains that pixels, fingerprinting and device identifiers can also be covered. Removing traditional cookies does not automatically remove your obligations.

Think of these as two checks. The cookie rules address storing or accessing information on a device. GDPR addresses personal-data processing, including what happens to information after collection. Both can apply to the same tracking activity, as explained in Datatilsynet’s guide for small businesses.

For your business, that means checking both the banner and the data flow. Understand what each tool collects, which organisations receive it and what it is used for. Consent collection does not settle every other data-protection question.

1. Separate necessary functions from optional tracking

The Cookie Order’s exemptions cover communication transmission and technical functions required to deliver a service the visitor explicitly requested. A basket cookie may qualify; a cookie used to assess campaign performance does not become necessary simply because the information is useful to your business.

Classify cookies by their actual purpose. Avoid putting a whole plugin into “Necessary” if it also performs optional tracking.

2. Make accepting and rejecting equally easy

Offer clear acceptance and rejection options in the first layer. Do not hide rejection behind extra settings or steer people towards acceptance through misleading design. The joint Danish guidance explains how banner design affects whether consent is freely given.

A practical starting point is “Accept all”, “Reject optional cookies” and “Choose settings”. Those labels are examples, not mandatory wording. Test the complete journey on mobile as well as desktop.

3. Collect an active choice for each purpose

Optional purposes should be off until selected. Let visitors accept statistics without accepting marketing. Pre-ticked boxes or a visitor’s silence do not establish valid consent: the European Data Protection Board requires a clear affirmative action.

Use descriptions that explain what a choice does. “Measure how visitors use our website” is more useful than an unexplained technical category.

4. Give visitors useful information

Your information should cover which cookies are used, who uses them, their purposes and expiry, and how consent can be withdrawn. These elements are set out in Datatilsynet’s cookie guidance for small businesses.

Keep the first layer readable and make details easy to find. Review the information whenever your tools change: a policy describing last year’s setup is a poor guide to today’s choices.

5. Make changing a choice straightforward

Visitors must be able to withdraw consent as easily as they gave it. The EDPB’s consent guidelines make this an ongoing requirement.

A persistent “Cookie settings” link is a practical way to reopen the choices. Check that withdrawal changes tracking behaviour rather than only changing the switches displayed in the banner.

What this means for analytics and marketing

Imagine a webshop with a basket cookie, analytics and advertising tracking. A visitor chooses statistics but rejects marketing. Your setup should reflect that combination rather than treating any click on the banner as permission for every tool.

Digitaliseringsstyrelsen’s website-statistics example requires consent even where analytics cookies are used to improve the website. “Only for our own statistics” is not a general exemption.

For campaign reporting, keep a record of changes to your banner and tracking configuration. If measured conversions change after a consent update, investigate whether collection changed before concluding that campaign performance changed. Compare reporting with business records, such as completed orders, while keeping the different measurement methods clear.

Website testing checklist

Test each scenario from a fresh session with previous site consent cleared. Check actual cookie and tracker activity as well as the visible banner.

Before a choice: confirm that non-essential cookies and tracking requiring consent have not started.
Reject optional cookies: reload the page and navigate to another page. Confirm the choice is still respected.
Accept statistics only: check that analytics follows the selection while marketing remains off.
Accept all: check that the intended tools activate and the selection is saved.
Withdraw consent: reopen settings, change the choice and confirm that the affected tracking stops.
Visit different page types: test a product page, checkout, campaign landing page and pages with embedded content.
Use mobile and desktop: check that buttons, explanations and settings remain visible and usable.
Check the information: compare the listed purposes and providers with the tools actually running.

Save the test date, results and any fixes. Repeat after adding tools or changing the website. This is a recommended operating routine, not a statutory testing schedule.

FAQ

Do I need a banner if I only use strictly necessary cookies?

You do not need to request consent for uses that fall within the Cookie Order’s exemptions. Check the actual setup before deciding that a consent banner is unnecessary.

Are first-party cookies exempt?

No. A cookie’s purpose matters more than whether it comes from your own domain. The Cookie Order does not provide a blanket exemption for first-party cookies.

Can visitors consent by scrolling or continuing to browse?

No. The EDPB’s consent guidelines reject scrolling as a valid affirmative action. Keep consent separate from ordinary navigation.

Does my cookie banner need to be in Danish?

Use language visitors can understand. The joint Danish guidance recommends that a Danish-language service also provides its consent solution and privacy information in Danish.

How often should I request consent again?

There is no fixed statutory interval. The joint guidance says annual renewal is often appropriate. Obtain new consent before introducing a use that existing consent does not cover.

Must I keep a separate consent record for every visitor?

The joint guidance allows system documentation demonstrating how valid consent is obtained. Preserve evidence of the information and choices presented without collecting unnecessary personal data solely for documentation.

What about videos, maps and other embedded content?

Check what the embedded service does. A third-party provider may introduce cookies through your site, and Digitaliseringsstyrelsen makes clear that an agreement with the provider does not remove your responsibility.

Can I require visitors to accept tracking to access the website?

Do not assume that a take-it-or-leave-it banner creates valid consent. Datatilsynet’s cookie-wall guidance requires a specific assessment; paid alternatives are not automatically valid.

Does installing a cookie banner make my website compliant?

No. Check the information, choices and actual tracking together. Datatilsynet’s practical guidance recommends checking your solution regularly and understanding the technologies used.

Who enforces the rules?

Digitaliseringsstyrelsen oversees the cookie rules and explains that breaches can attract fines. Datatilsynet oversees personal-data processing under the related data-protection rules.