Contents
- What gets websites fined (and what doesn't)
- 1. Non-compliant banners that are worse than nothing
- 2. No records of consent
- 3. Missing or buried privacy policy
- What typically does not get fined
- Typical fine ranges
- Recent enforcement: what regulators actually did
- The 5-point self-check
- Check items 1–3 automatically
GDPR cookie banner fines: What websites actually get fined for (2026)
Most website owners know they need a cookie banner. Far fewer know what actually gets a site fined — and it's usually not "no banner at all". Data protection authorities across the EU consistently penalise a small set of specific, fixable mistakes.
This article walks through real enforcement patterns, the amounts involved, and how to check whether your own setup has the same weaknesses — before an authority or a competitor's complaint does.
What gets websites fined (and what doesn't)
1. Non-compliant banners that are worse than nothing
The single most common trigger is a banner that looks compliant but isn't:
- Pre-ticked boxes for non-essential cookies — explicitly rejected by the CJEU in the Planet49 ruling (C-673/17)
- "Reject" is harder than "Accept" — hidden, greyed-out or missing reject buttons have drawn fines from multiple DPAs, including France's CNIL (Google and Meta fines of €150M and €60M respectively, partly for this)
- Cookies fire before consent — tracking scripts that load on page view, before any click. This is technically detectable by anyone with a browser dev tools window, which is exactly who files complaints
2. No records of consent
GDPR Article 7(1) puts the burden of proof on you. If you can't show when and how each user consented, regulators treat the consent as never having happened. Fines here are common because most small-site consent setups store nothing at all.
3. Missing or buried privacy policy
A cookie banner that doesn't link to a privacy policy explaining cookie purposes, retention periods and third parties fails the "informed" requirement. Several DPAs issue low-level fines and reprimands for this daily — they rarely make headlines but they do land in your inbox.
What typically does not get fined
Strictly necessary cookies without consent (legal under ePrivacy Art. 5(3)), first-party session cookies, and banners that simply use an unusual design as long as consent is freely given, informed and revocable. Design taste isn't regulated; mechanics are.
Typical fine ranges
| Violation | Typical range | Note |
|---|---|---|
| No valid consent mechanism | €2,000 – €100,000+ | Scales with traffic and data sensitivity |
| Tracking before consent | €5,000 – €60M | Meta/Google cases sit at the extreme end |
| Missing reject option / dark patterns | €40,000 – €150M | CNIL 2022 decisions set the benchmark |
| No privacy policy link / incomplete info | €500 – €20,000 | Most common outcome for SMB sites after complaints |
Recent enforcement: what regulators actually did
These are real decisions from 2024–2026, each verified against the authority's own announcement:
| When | Who | Fine / action | What went wrong |
|---|---|---|---|
| Sep 2025 | Google (France, CNIL) | €325M | Ads in Gmail without valid consent; coercive cookie practices. Third CNIL fine for Google's cookies (after €100M in 2020 and €150M in 2021). |
| Sep 2025 | SHEIN (France, CNIL) | €150M | Advertising cookies placed before any user choice; reject/withdrawal mechanisms ineffective; incomplete banner information. |
| Dec 2025 | UK top-1,000 sites (ICO) | Enforcement sweep | 564 of the UK's 1,000 biggest websites failed initial checks and only complied after ICO letters, investigations and 17 preliminary enforcement notices; 21 still failing. |
| 2024 | Kruidvat / AS Watson (Netherlands) | €600,000 | Tracking cookies without valid consent; pre-ticked-style consent mechanics. |
| Apr 2025 | Warner Music Sweden, Aller Media et al. (Sweden, IMY) | Formal warnings | Banners designed to favour "Accept" over "Reject". |
Sources: CNIL press releases (cnil.fr, 1 & 3 Sep 2025), EDPB case register, ICO news release (4 Dec 2025), Dutch DPA decision on AS Watson, Swedish IMY supervisory notices.
The pattern across every case is the same three failures: cookies before consent, a harder-to-find reject option, and incomplete information. None of these require enterprise budgets to fix — they are implementation mistakes.
The 5-point self-check
- Nothing fires before the click. Open your site in an incognito window with dev tools open. No analytics, marketing or embed cookies may appear before consent.
- Reject is one click, equal weight. Same size, same contrast, same number of clicks as accept.
- Consent is logged. Your CMP stores timestamp + choices per user.
- Banner links to your privacy policy, which names cookie categories, purposes, retention periods and third parties.
- Withdrawal works. A visible "cookie settings" path lets users change their mind as easily as they said yes.
Check items 1–3 automatically
Our free scanner checks any URL — WordPress, Shopify, Webflow, Next.js, Squarespace or plain HTML — for consent-banner presence, HTTPS hardening and privacy-policy linking, and tells you exactly what to fix:
Passed? Show it off — add a free compliance badge to your site (great for client trust and a dofollow backlink).
Want document tools for WordPress? EUComply Pro ($79/year per website) provides editable HTML starters and an HTML report from the latest scan. Hosted monitoring, signed reports and automated policy generation are planned, not included today; the compliance checklist helps you draft the policies yourself.