Dutch Business Website Legal Requirements for DAFT

When we launched our business website in the Netherlands, we assumed the same rules applied as in the US. Put up a site, maybe add a privacy policy, and you're good.

Not quite. Under the Dutch-American Friendship Treaty (DAFT), your business operates under Dutch and EU law—and that means your website needs specific elements that US sites don't typically include.

Here's what's legally required and what's strongly recommended.

Required Information on Your Website

Dutch law requires commercial websites to display certain business information. This comes from EU e-commerce directives implemented in Dutch civil law (Burgerlijk Wetboek).

You must include:

Your business name (as registered at KVK)
Your KVK number
Your BTW (VAT) number
Your business address (this can be your home address)
An email address (a contact form alone isn't sufficient)
Your name or the name of the business owner

Most Dutch businesses put this in the footer or on a dedicated "About" or "Contact" page. A footer with "KVK: 12345678 | BTW: NL123456789B01" is the standard approach.

What We Wish We Knew: The email requirement caught us off guard. Having only a contact form is not enough under Dutch law. You need an actual email address visible on the site. It can be info@yourdomain.com, but it needs to be there.

Get the guide to starting your DAFT business$99

Privacy Policy (Privacyverklaring)

Under GDPR (which applies to all businesses in the Netherlands), you need a privacy policy if your website collects any personal data. And nearly every website does—through contact forms, analytics, email signups, or cookies.

Your privacy policy must explain:

What personal data you collect
Why you collect it (legal basis)
How long you store it
Who you share it with (including third-party services)
How people can request their data or ask for deletion
Your contact information for privacy-related requests

In practice: If you use Google Analytics, a contact form, or an email newsletter signup, you need a privacy policy. Write it in clear, plain language—not legal jargon.

Templates are available from the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl. For a deeper look at GDPR obligations, see our guide on GDPR compliance for US entrepreneurs.

Cookie Consent

The Dutch Telecommunicatiewet (Telecommunications Act) requires explicit consent before placing non-essential cookies. This is stricter than what most US websites do.

What this means:

Analytics cookies (Google Analytics, PostHog) require consent
Marketing cookies (Facebook Pixel, Google Ads) require consent
Functional cookies (language preferences, shopping cart) don't require consent
Strictly necessary cookies (session cookies, security) don't require consent

Implementation:

You need a cookie banner that:

Appears before non-essential cookies are loaded
Allows users to accept or reject cookies
Doesn't pre-check optional cookie categories
Actually blocks cookies until consent is given (not just showing a banner while loading cookies anyway)

Cookie consent tools like Cookiebot (from €12/month), CookieYes (free tier available), or Complianz (WordPress plugin, €45/year) handle this technically.

Reality Check: Many websites—including big Dutch companies—implement cookie consent poorly. But the Autoriteit Persoonsgegevens does fine businesses for non-compliance, and fines start at €10,000. It's worth doing correctly.

Book a 1-Hour Consultation$299

Terms and Conditions (Algemene Voorwaarden)

Terms and conditions are not strictly required by law, but they're strongly recommended for any business that sells services or products online.

Your terms should cover:

Scope of services
Payment terms and methods
Delivery timelines
Cancellation and refund policies
Liability limitations
Applicable law and dispute resolution
For consumers: 14-day withdrawal right (herroepingsrecht) for online purchases

If you sell to consumers (B2C), the right of withdrawal is legally required. Online consumers in the EU have 14 days to cancel a purchase without giving a reason. This applies to digital products, physical goods, and services.

If you sell only to businesses (B2B), the withdrawal right doesn't apply, but clear payment terms and liability clauses are still important.

Having a Dutch lawyer review your terms costs €200-500 and is worth it if you're selling to Dutch clients regularly.

Invoicing From Your Website

If you sell products or services through your website, your checkout process must comply with Dutch invoicing rules:

Show prices including VAT (for B2C) or clearly state whether prices are excluding VAT
Provide an invoice for every transaction
Include all required invoice fields (KVK number, VAT number, sequential invoice number)

For complete invoicing requirements, see our guide on Dutch invoice requirements.

Accessibility

While not yet fully enforced for private businesses, the European Accessibility Act (coming into full effect in 2025) pushes businesses toward accessible websites. This means:

Proper heading structure
Alt text on images
Sufficient color contrast
Keyboard navigability
Screen reader compatibility

This mainly affects larger businesses and public-facing services, but building an accessible site from the start is good practice and avoids future retrofitting.

Domain and Hosting Considerations

A few practical points:

Domain choice: .nl domains are popular for Dutch-facing businesses. .com works fine for international businesses. Both are acceptable. A .nl domain can help with local SEO if you're targeting Dutch clients.

Hosting location: No legal requirement to host in the Netherlands, but hosting within the EU simplifies GDPR compliance for data processing.

SSL certificate: While not a Dutch-specific requirement, HTTPS is expected for any business website. Most hosting providers include free SSL certificates.

Checklist

Before launching your business website, verify:

This covers the legal basics. For ongoing business compliance, check our annual requirements guide.

Enforcement and Penalties

The Autoriteit Consument & Markt (ACM) enforces e-commerce rules. The Autoriteit Persoonsgegevens (AP) enforces GDPR and cookie rules.

Penalties for non-compliance:

Missing business information: warnings first, then fines up to €900,000
GDPR violations: fines up to €20 million or 4% of annual revenue
Cookie violations: fines starting at €10,000

In practice, enforcement targets larger companies first. But as a registered Dutch business, you're subject to these rules, and complaints from customers can trigger investigations.

The best approach: get it right from the start. It takes a few hours of setup and gives you peace of mind. For other legal considerations for freelancers, see our guide on Dutch contract templates.

Frequently Asked Questions

Q: My website only targets US clients. Do Dutch rules still apply? A: Yes. If your business is registered in the Netherlands, Dutch law applies to your website regardless of your target audience. The KVK/BTW display requirements and GDPR obligations follow the business, not the customer.

Q: Can I copy a privacy policy from another website? A: Don't. Your privacy policy must accurately reflect your specific data processing activities. Use a template from the Autoriteit Persoonsgegevens and customize it, or use a privacy policy generator that asks about your actual practices.

Q: Do I need a website for my DAFT business? A: It's not legally required for DAFT, and the IND doesn't require one. But for most service businesses, a professional website helps you look legitimate to potential clients and strengthens your case at IND renewal by showing genuine business activity.

Get the Complete Guide

Digital Guide — $99

We're not immigration lawyers—just Americans who did this. Requirements change, so verify with official sources.