In short. A Danish website needs informed, active consent before nonessential cookies, with clear information and accessible refusal and withdrawal controls.
Definition: A cookie is a small data file stored on a visitor's device. Under Denmark's Cookie Order Section 3, a website must obtain informed consent before storing or accessing information on that device, including through third parties, unless a Section 4 exception applies.
Key facts
- Cookie Order Section 3 requires information about purposes, the parties responsible and accessible ways to refuse or withdraw consent.
- As of 17 October 2026, Digitaliseringsstyrelsen's current cookie guidance, updated 16 May 2025, requires consent before cookies are placed and a clear affirmative action from the visitor.
- Digitaliseringsstyrelsen and Datatilsynet's joint guidance explains that collecting personal data also triggers data protection requirements, including a lawful basis.
What information does Section 3 require?
Section 3(2) of the Cookie Order sets minimum requirements for adequate information. It must use clear, precise and easily understood language or equivalent pictograms, explain the purposes of storage or access, and identify every person or organisation arranging it. This includes third parties allowed to store or access information through the website.
The information must provide immediately accessible ways to refuse consent or withdraw it, with clear instructions. It must be presented together and prominently. For a website, the information must remain available through a direct, clearly marked access point.
Digitaliseringsstyrelsen's current guidance also requires disclosure of cookie lifetimes. Detailed information about the technologies, their purposes and expiry dates can appear in a second layer of the consent interface, alongside instructions for withdrawal.
What counts as valid consent?
Digitaliseringsstyrelsen's guidance on valid consent describes consent as freely given, specific, informed and unambiguous. The visitor must actively agree before the website collects information using nonessential cookies. Continuing to browse, preselected boxes and sliders already switched on are insufficient.
Visitors must be able to consent separately to different purposes. Refusing consent must be as easy as giving it, and withdrawal must be as easy as the original consent action. The same guidance gives a prominent link at the top or bottom of the website, or a persistent icon accessible from every subpage, as ways to provide withdrawal access.
Which cookies fall under Section 4?
Section 4(1) of the Cookie Order provides two exceptions. Storage or access can serve solely to transmit a communication over an electronic communications network. Alternatively, it can be required to deliver an online commercial service that the visitor expressly requests.
These exceptions remove Section 3's information and consent duties. Section 4(2) defines the latter necessity as a technical prerequisite for delivering a service that functions according to its purpose. Digitaliseringsstyrelsen's examples of technically necessary technologies include keeping a visitor logged in, remembering shopping-basket contents and saving actively selected language settings. The exemption requires that the collected information serves the necessary functionality without being used for additional purposes.
Related terms
- Which website cookies fall within the ePrivacy consent exemption?
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Do analytics cookies require consent?
Yes. Digitaliseringsstyrelsen's cookie guidance expressly requires consent for cookies used to generate visitor statistics or display personalised advertising.
Must you obtain consent for an electronic shopping basket?
The same guidance lists technologies that remember basket contents while visitors move around a shop as technically necessary. The exemption applies when the collected information serves only the necessary functionality.
Does an exemption also settle personal data obligations?
The authorities' joint guidance explains that personal data collection and subsequent processing also fall under data protection rules, including the requirement for a lawful basis. The Cookie Order regulates storage and access on the device.
Sources
- Erhvervs- og Vækstministeriet, "Cookiebekendtgørelsen", 9 December 2011
- Digitaliseringsstyrelsen, "Cookievejledningen", updated 16 May 2025
- Digitaliseringsstyrelsen and Datatilsynet, "Brug af cookies og lignende teknologier", May 2025
Check how a page reads to answer engines. Open the GEO score analyzer