Next.js Cookie Compliance in Belgium: Privacy Evidence and Monitoring Checklist

Introduction

*Updated for 2026 compliance practices.*

Next.js cookie compliance in Belgium requires website owners to validate consent, tags, and disclosures under the GDPR and the Belgian implementation of the ePrivacy Directive. This practical guide provides a step-by-step approach to implementing and verifying cookie compliance for Next.js applications, with a focus on privacy evidence and ongoing monitoring. It is designed for developers, compliance officers, and website owners who need to ensure their Next.js sites meet Belgian and EU requirements. The guide covers technical implementation, common pitfalls, and how to use GDPRChecker to validate your setup. It does not constitute legal advice; always consult a qualified privacy professional for your specific situation.

What is Next.js Cookie Compliance in Belgium?

Next.js cookie compliance in Belgium refers to the set of technical and organizational measures required to ensure that a website built with the Next.js framework respects Belgian and EU regulations on cookies and similar tracking technologies. In Belgium, the core legal framework is the GDPR, supplemented by the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and the ePrivacy Directive as transposed into Belgian law. The Belgian Data Protection Authority (APD/GBA) enforces these rules and has issued guidance on cookie consent.

For Next.js sites, compliance means that before any non-essential cookies or trackers are set or accessed on a user's device, the site must obtain valid consent. This consent must be freely given, specific, informed, and unambiguous. Essential cookies (strictly necessary for the service requested by the user) may be exempt from consent, but their use must still be disclosed. The checklist in this guide helps you gather evidence that your Next.js application meets these requirements and can be monitored over time.

Key Requirements for Next.js Cookie Compliance in Belgium

Consent Before Cookies

The fundamental rule is that non-essential cookies must not be placed or read before the user has given consent. In a Next.js application, this means you must control when scripts that set cookies (like analytics or marketing tags) are loaded. This is often achieved by integrating a Consent Management Platform (CMP) that blocks such scripts until consent is obtained.

Granular Consent

Users must be able to choose which categories of cookies they accept. A simple "Accept All" button is not sufficient; you must offer a way to reject non-essential cookies as easily as to accept them. The Belgian DPA has emphasized that cookie walls (making access to the site conditional on consent) are not compliant.

Clear and Comprehensive Information

Your cookie banner and privacy policy must provide clear information about the cookies used, their purposes, duration, and any third-party recipients. This information must be available before consent is given. In Next.js, you can render this information in a modal or banner component that appears on first visit.

Evidence of Consent

You must be able to demonstrate that valid consent was obtained. This means keeping records of consent choices, including timestamp, user identifier (if applicable), and the specific consent given. For Next.js sites, this often involves storing consent preferences in a cookie or local storage and logging consent events to a server.

Ongoing Monitoring

Compliance is not a one-time task. You must regularly monitor your site for new cookies, changes in third-party scripts, and any consent gaps. This is where automated scanning tools like GDPRChecker become essential.

How to Implement Next.js Cookie Compliance Step by Step

Step 1: Audit Your Cookies and Trackers

Before implementing any consent mechanism, you need to know exactly what cookies and trackers your Next.js site uses. Use GDPRChecker's scanner to perform a comprehensive scan of your site. The scanner will identify all cookies, local storage items, and network requests that may set cookies. Document each cookie's name, domain, purpose, duration, and whether it is first-party or third-party. This inventory forms the basis of your cookie policy and consent configuration.

Step 2: Choose and Integrate a Consent Management Platform (CMP)

For Next.js, you can integrate a CMP via a script tag or a React component. Popular CMPs offer Next.js-specific libraries or you can use a generic JavaScript approach. The CMP should support: - Blocking scripts until consent is given (prior blocking) - Granular consent categories - A "Reject All" button that is as prominent as "Accept All" - Storing consent preferences and providing a mechanism to withdraw consent

When integrating, ensure the CMP script is loaded as early as possible, typically in the `<Head>` of your Next.js `_document.js` or `_app.js`. Configure the CMP to block all non-essential tags by default. For Google services, implement Google Consent Mode v2 to adjust tag behavior based on consent state (see Google Consent Mode).

Step 3: Configure Google Consent Mode v2

If you use Google Analytics, Google Ads, or other Google services, you must implement Consent Mode v2. This allows tags to dynamically adjust their behavior based on the user's consent choices. In a Next.js app, you typically set the default consent state to 'denied' for all parameters and then update it when the user grants consent. Example:

```javascript // In your _app.js or a custom script window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('consent', 'default', { 'ad_storage': 'denied', 'analytics_storage': 'denied', 'ad_user_data': 'denied', 'ad_personalization': 'denied', 'wait_for_update': 500 }); ```

When consent is given, update the consent state accordingly. GDPRChecker can verify that Consent Mode is correctly implemented and that no Google tags fire before consent.

Step 4: Build a Compliant Cookie Banner

Your Next.js cookie banner should be a React component that appears on first visit and respects the user's choices. It must: - Clearly state that the site uses cookies and why - Provide a link to the full privacy policy and cookie policy - Offer buttons to accept all, reject all, or customize settings - Not use pre-ticked boxes - Be responsive and accessible

Store the user's consent choice in a cookie or local storage so the banner is not shown again on subsequent visits, but always provide a floating button or link to change preferences.

Step 5: Implement Prior Blocking

Prior blocking ensures that no non-essential scripts run before consent. In Next.js, you can achieve this by conditionally loading scripts based on consent. For example, you might wrap third-party script components in a consent check:

```jsx {hasConsent('analytics') && <AnalyticsScript />} ```

Alternatively, use a tag manager that supports consent-based triggers. Ensure that essential scripts (like those needed for the site to function) are not blocked.

Step 6: Update Your Privacy Policy

Your privacy policy must include a detailed cookie section. It should list all cookies by category, explain their purpose, duration, and any third-party access. The policy must be easily accessible from every page, typically via a footer link. In Belgium, the policy should also include contact details of the data controller and information on data subject rights. For guidance, see the European Data Protection Board and GDPR.eu.

Step 7: Test and Validate with GDPRChecker

After implementation, run a full scan with GDPRChecker. The scanner will check: - Whether cookies are set before consent - If the consent banner appears correctly - If the "Reject All" button works as expected - If Google Consent Mode is properly configured - If your privacy policy is linked and contains required information

Use the scanner's evidence reports to document compliance. Schedule regular scans to catch any regressions after site updates.

Common Mistakes and How to Avoid Them

Mistake 1: Loading Scripts Before Consent

A frequent error in Next.js is loading analytics or marketing scripts in the `<Head>` without conditional logic. Even if a CMP is present, if the script is loaded before the CMP can block it, cookies may be set. Always use prior blocking or load scripts only after consent is confirmed.

Mistake 2: Inadequate Reject Mechanism

Some banners make rejecting cookies harder than accepting them, e.g., by hiding the reject option in a second layer. The Belgian DPA requires that refusing cookies be as easy as accepting them. Ensure your banner has a clearly visible "Reject All" button on the first layer.

Mistake 3: Ignoring Third-Party Scripts

Next.js sites often embed third-party services like YouTube videos, social media widgets, or chat plugins. These can set cookies without your direct control. You must either block these until consent is given or replace them with placeholders that require a click to activate (two-click solution).

Mistake 4: Not Monitoring for New Cookies

After initial compliance, new cookies can appear due to plugin updates, new marketing tools, or developer changes. Without ongoing monitoring, you may become non-compliant without realizing it. Set up regular GDPRChecker scans to detect new cookies and trackers.

Mistake 5: Storing Consent Without Evidence

Simply storing a consent cookie is not enough; you need to be able to prove that consent was validly obtained. This means keeping server-side logs or using a CMP that provides a consent receipt with a timestamp and the specific choices made.

How to Validate with GDPRChecker

GDPRChecker provides a comprehensive scanning and monitoring solution for Next.js cookie compliance in Belgium. Here's how to use it effectively:

1. **Initial Scan**: Run a full scan of your Next.js site. The scanner will crawl your pages and identify all cookies, trackers, and consent-related issues.
2. **Pre-Consent Check**: Verify that no non-essential cookies are set before the user interacts with the consent banner. GDPRChecker simulates a first-time visit and checks network requests.
3. **Banner Behavior**: Test that the consent banner appears correctly, that all buttons work, and that consent choices are respected on subsequent page loads.
4. **Consent Mode Validation**: If using Google Consent Mode, GDPRChecker checks that the default consent state is set to 'denied' and that tags update correctly after consent.
5. **Policy Link Verification**: Ensure your privacy policy is linked from the banner and contains the required cookie disclosures.
6. **Scheduled Monitoring**: Set up regular scans (e.g., weekly) to detect any new cookies or consent gaps. GDPRChecker can alert you to changes.
7. **Evidence Reports**: Generate reports that serve as documentation of your compliance efforts. These can be used to demonstrate accountability to the Belgian DPA if needed.

For advanced needs, GDPRChecker's paid plans offer managed consent banners, runtime protection, consent records, and more. See our GDPR checklist for small businesses for a broader compliance overview.

Implementation Checklist

Use this numbered checklist to ensure your Next.js site meets cookie compliance requirements in Belgium:

1. Run an initial GDPRChecker scan to inventory all cookies and trackers.
2. Classify each cookie as essential or non-essential; document purposes and durations.
3. Select and integrate a CMP that supports prior blocking and granular consent.
4. Implement Google Consent Mode v2 with default 'denied' state for all Google services.
5. Build a cookie banner component with clear Accept All, Reject All, and Customize options.
6. Ensure the banner appears on first visit and does not set non-essential cookies before interaction.
7. Implement prior blocking for all non-essential scripts (analytics, marketing, social media).
8. Update your privacy policy with a detailed cookie section, including all required disclosures.
9. Test the full consent flow: accept, reject, customize, and withdraw consent.
10. Verify with GDPRChecker that no pre-consent cookies are set and that Consent Mode works.
11. Set up regular GDPRChecker scans (at least monthly) to monitor for new cookies.
12. Keep records of consent logs and scan reports as evidence of compliance.

Comparison: DIY vs. Managed Compliance

| Aspect | DIY Approach | GDPRChecker Managed Solution | |--------|--------------|------------------------------| | Initial Setup | Manual integration of CMP, scripts, and policies | Guided setup with pre-configured banner and blocking rules | | Cookie Inventory | Manual scanning and documentation | Automated scanning with continuous inventory updates | | Consent Evidence | Self-managed logs, often incomplete | Automated consent records with timestamps and receipts | | Monitoring | Ad-hoc checks, easy to miss changes | Scheduled scans with alerts for new cookies or gaps | | Google Consent Mode | Manual implementation and testing | Built-in diagnostics and validation | | Policy Updates | Manual updates when cookies change | Scanner flags discrepancies between policy and actual cookies | | Ongoing Maintenance | Developer time required for every change | Dashboard-managed blocking and configuration |

For many Next.js site owners, a managed solution reduces the risk of non-compliance and saves time. However, even with a managed solution, you remain responsible for ensuring the legal sufficiency of your consent mechanisms.

Real-World Examples

Example 1: E-commerce Site with Google Analytics and Facebook Pixel

A Belgian e-commerce site built with Next.js uses Google Analytics 4 and Facebook Pixel for marketing. Without proper consent, these scripts set third-party cookies on page load. The site integrated a CMP with prior blocking and Google Consent Mode v2. GDPRChecker scans confirmed that no analytics or marketing cookies were set before consent. After the user accepted, the scripts loaded and cookies were set. The site also implemented a "Reject All" button that prevented all non-essential cookies. Regular scans ensured that when the marketing team added a new tracking script, it was immediately flagged and blocked until consent configuration was updated.

Example 2: SaaS Blog with Embedded YouTube Videos

A SaaS company's Next.js blog embedded YouTube videos. These embeds set cookies from Google even if the user didn't play the video. To comply, the site replaced direct embeds with a click-to-load placeholder. Only when the user clicked the placeholder did the video load and cookies get set. The cookie banner informed users about this and offered a choice. GDPRChecker verified that no YouTube cookies appeared on the initial page load.

Example 3: Corporate Site with Live Chat

A Belgian corporate site used a live chat widget that set cookies for session management. The widget was essential for customer support, but it also set a persistent cookie for analytics. The site configured the chat to load only the essential session cookie before consent, and the analytics cookie only after consent. GDPRChecker's pre-consent scan confirmed that only the strictly necessary cookie was present, and the analytics cookie appeared only after acceptance.

FAQ

What is Next.js cookie compliance Belgium privacy evidence and monitoring checklist? It is a practical framework for ensuring that a Next.js website meets Belgian and EU cookie regulations. It covers obtaining valid consent, blocking non-essential cookies before consent, keeping records, and regularly monitoring the site with tools like GDPRChecker to maintain compliance.

Do I need Next.js cookie compliance Belgium privacy evidence and monitoring checklist for GDPR? Yes, if your Next.js site targets users in Belgium or the EU and uses non-essential cookies, you must comply with the GDPR and ePrivacy Directive. The checklist helps you implement and document the required measures, reducing the risk of fines from the Belgian Data Protection Authority.

How do I implement Next.js cookie compliance Belgium privacy evidence and monitoring checklist? Start by auditing cookies with GDPRChecker, then integrate a CMP with prior blocking, configure Google Consent Mode v2, build a compliant banner, update your privacy policy, and validate with scans. Follow the step-by-step guide in this article for detailed instructions.

How can I verify Next.js cookie compliance Belgium privacy evidence and monitoring checklist with a scanner? Use GDPRChecker to scan your Next.js site. It checks for pre-consent cookies, banner behavior, Consent Mode configuration, and policy links. Regular scans provide evidence of compliance and alert you to new cookies or gaps.

What are common Next.js cookie compliance Belgium privacy evidence and monitoring checklist mistakes? Common mistakes include loading scripts before consent, making rejection harder than acceptance, ignoring third-party embeds, failing to monitor for new cookies, and not keeping adequate consent records. These can lead to non-compliance and potential penalties.

Which cookies and trackers should I check for Next.js cookie compliance Belgium privacy evidence and monitoring checklist? Check all cookies and trackers, including analytics (e.g., Google Analytics), marketing (e.g., Facebook Pixel), social media widgets, embedded content (e.g., YouTube), and chat plugins. Essential cookies may be exempt but must still be disclosed.

How often should I review Next.js cookie compliance Belgium privacy evidence and monitoring checklist? Review at least monthly, or whenever you make changes to your Next.js site, add new third-party services, or update plugins. Regular GDPRChecker scans can automate this review and catch issues early.

What evidence should I keep for Next.js cookie compliance Belgium privacy evidence and monitoring checklist? Keep records of consent logs (timestamps, user choices), cookie inventories, privacy policy versions, CMP configurations, and GDPRChecker scan reports. This documentation demonstrates accountability to regulators.

Conclusion

Achieving Next.js cookie compliance in Belgium requires a combination of technical implementation, clear disclosures, and ongoing monitoring. By following the privacy evidence and monitoring checklist outlined in this guide, you can build a compliant Next.js application that respects user choices and meets regulatory expectations. Remember that compliance is an ongoing process; regular scans with GDPRChecker help you stay ahead of changes and maintain the necessary evidence. For further reading, explore our guides on Google Analytics GDPR compliance and cookie banner requirements. To start verifying your site today, run a free scan with GDPRChecker and close any consent gaps.

Next step

Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.

Related GDPRChecker guides

• [Consent Mode v2 vs Google Certified CMP: Which One Does Your Website Need?](/guides/consent-mode-v2-vs-google-certified-cmp)
• [Do I Need a CMP If I Don't Run Google Ads?](/guides/do-i-need-a-cmp-if-i-do-not-run-google-ads)

> This guide is technical implementation guidance for website owners. It is not legal advice.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Next.js Cookie Compliance in Belgium: Privacy Evidence and Monitoring Checklist", "description": "Practical guide to Next.js cookie compliance in Belgium. Step-by-step implementation, evidence collection, and monitoring checklist with GDPRChecker scanner verification.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/next-js-cookie-compliance-in-belgium-privacy-evidence-and-monitoring-checklist" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice