Frequently asked questions

Yes, the banner can be. Each domain shows its banner in English or Dutch, and you can change every text it shows. The dashboard is in Dutch for now.

Yes, if each site is in one language. Pick English as the banner language and type your own text over each English one. A site in several languages isn't served yet, so tell us which languages your sites use when you request access.

No. Fleetorix is for EU sites under the GDPR, where visitors opt in to cookies. It supports the GDPR, not US privacy laws such as the CCPA/CPRA, where visitors opt out.

Try Fleetorix free for 30 days on Starter. You don't need a credit card.

If you move to a larger plan during the trial, the trial ends and you pay for that plan straight away.

After the trial, you pay for your plan monthly or yearly. If you don't pay, everything keeps working for 14 days. After that the dashboard is limited, but the banner keeps working on your domains. After 60 days the agreement ends.

You pay monthly or yearly through Paddle, by credit card or PayPal.

No. All prices exclude VAT, whether you pay monthly or yearly.

At your limit you can't add another domain, and your existing domains keep working. Move to a larger plan to add more.

Contact us if you need more than 50 domains.

With your Google or GitHub account, or with a sign-in link we email to you.

Your consent log and account data are stored in the EU, in Frankfurt.

We ask for consent again after 12 months, or as soon as you change the cookie categories of the banner. However, Safari clears what a site stores in the browser when the visitor hasn't clicked or typed anything on that site for 7 days.

So a Safari visitor who does nothing on your site for that long sees the banner again, even if they viewed pages in between. That's a limitation of Safari, and it works in the visitor's favour: without a stored choice, only what is strictly necessary runs.

The banner appears and the visitor's choice works on that page. But over HTTP the browser can't encrypt the visitor ID securely, so we don't store the choice and receive no consents. The visitor then sees the banner on every visit, and the dashboard keeps showing your domain as “nog niet gezien” (not seen yet). Move your site to HTTPS to fix this.

You need one if your site stores or reads information on a visitor’s device for anything that isn’t strictly necessary, such as an advertising pixel or most analytics. The rule is about the device and about tracking, not about cookies: a site without cookies can still need consent, and a site with cookies may not.

No law asks for a document called a cookie policy, but the law does ask for the information one holds. Before setting cookies that need consent, you must tell visitors clearly and fully what you store or read on their device, why, who else gets access, and for how long. When the cookies involve personal data, the GDPR adds who you are, your legal basis and the visitor’s rights. A banner has no room for all of that, so regulators expect layers: the key facts in the banner and the full details one click away, on a page you link from every page of your site. A cookie page or a cookie section in your privacy statement both work.

Yes, even when it sets no cookie. European regulators say that loading a tracking pixel already stores something on the visitor’s device, and that the pixel’s script tells the device to send information back. Either way the consent rule applies, and no exemption covers advertising.

Usually, yes. The ePrivacy Directive has no exemption for analytics, so tools such as Google Analytics need consent unless a national exemption covers them. In the EU, only the Netherlands has one in its statute. France, Spain and Italy have regulator guidance with stricter conditions, and Germany, Belgium, Ireland and Denmark have none. The UK has had one in statute since 5 February 2026.

No. Cookies and similar storage that are strictly necessary to give visitors a service they asked for, such as keeping them signed in, need no consent. But exempt isn’t silent: you should still tell visitors which cookies you use and why, and the GDPR’s duty to inform applies whenever personal data is involved.

Usually, yes. The cookie rule’s exemption lifts both the need for consent and the duty to inform: the EU directive, and Dutch, French and UK law, all say so. But the GDPR has no such exemption. When a strictly necessary cookie involves personal data, as a sign-in session does, you must tell visitors who you are, why you process the data, on what legal basis, who receives it and for how long. Only a cookie that holds no personal data, such as one that stores nothing but a language choice, falls outside both duties, and France’s CNIL still recommends mentioning it in your privacy policy. The simplest course is to mention every cookie you set, necessary or not.

No law sets a term. The EDPB only says consent should be refreshed at appropriate intervals, and the Dutch regulator gives no number. Regulators that do give one advise 6 months (France, Ireland, Belgium and the UK), once a year (Denmark) or at most 24 months (Spain), all as advice, not law. The often-quoted 13 months isn’t a consent term at all.

No. No law sets a term for consent. Thirteen months is the lifespan that France’s CNIL and Spain’s AEPD recommend, as an example, for the trackers of analytics that are exempt from consent. It isn’t a rule about how long consent lasts or how often you have to ask again.

Fleetorix asks them again 12 months after they refused, just as it does after an acceptance, and sooner as soon as you publish a banner with a different set of cookie categories. Regulators advise against asking again too soon: Italy’s Garante says not until at least 6 months have passed, and the UK’s ICO says only after a reasonable amount of time, with six months as its general guideline. Both expect you to ask again sooner when what you do changes, for example when you add new kinds of cookies. The EU’s Digital Omnibus, a proposal and not law on 18 October 2026, would make six months the minimum after a refusal.

No law or regulator sets a number. The GDPR says you must be able to prove consent, and the EDPB says to keep that proof while you rely on the consent, then no longer than strictly necessary for legal claims. In the Netherlands, 5 years is a reasonable choice: it matches the time the regulator has to fine a violation and the limitation period for damages claims.

Reject must be as easy as Accept: on the same layer of the banner, as easy to see, and with no extra clicks. Cookie walls, which keep visitors out until they agree, aren’t allowed, because consent that’s the price of entry isn’t freely given.

The same way they gave it, and just as easily: the GDPR says withdrawing consent must be as easy as giving it. If visitors agree with one click on your banner, they need a way back that takes about one click too and that they can find at any time, such as a button or link that opens the banner again.

No. Consent Mode is how your site tells Google’s tags what a visitor chose. It doesn’t ask anyone anything, so it isn’t consent and gives you no legal basis. You still need a banner to ask, and Google itself requires you to collect consent from visitors in the EEA and pass it on through Consent Mode.

Nothing yet. The Digital Omnibus is a proposal the European Commission made in November 2025, and on 18 October 2026 it hadn’t been adopted, so none of it applies today. Both the Commission’s text and the latest Council draft would add a rule not to ask a visitor who refused again for at least six months.