EUComply

GDPR cookie fines tracker: every major consent penalty (2025–2026)

Published 24 August 2026 · Updated regularly · 9 min read · GDPR Enforcement Cookies

Cookie-consent enforcement has moved from warnings to nine-figure fines. Regulators now use automated scanning tools to find non-compliant banners at scale, and the companies being fined are not obscure — they are some of the most visited sites in Europe.

This page tracks the major public decisions, what each company actually did wrong, and — more usefully for you — the small set of patterns behind nearly every fine. Most of them are detectable on any website in seconds.

The practical takeaway first: run the free EUComply scan on your own URL. It checks consent-banner presence, pre-consent trackers, HTTPS hardening and privacy-policy linking on any website — WordPress or not, no sign-up.

The tracker: major cookie consent decisions

CompanyFineWhenWhat went wrong
Google€325MSep 2025Ads personalisation without prior consent in Gmail; misleading banner interface that made refusal harder than acceptance
SHEIN€150MSep 2025Advertising cookies placed before any interaction with the banner; "Reject all" failed to actually stop cookies
Free Mobile€27MJan 2026Broader data protection failures including consent handling
Free€15MJan 2026Data protection failures including consent mechanisms
Les Publications Condé Nast (vanityfair.fr)€750kNov 2025Cookies placed on the vanityfair.fr site without the user's prior consent — proof that media brands of every size are in scope
American Express (France)€1.5MJan 2026Cookies placed before the user's choice — and continuing even after explicit refusal
Meta (benchmark)€150M+2022 CNIL"Reject" required more clicks than "Accept"; the dark-pattern benchmark DPAs still cite
Google & Meta (benchmark)€150M / €60M2022 CNILSame refusal asymmetry — the decisions that defined today's enforcement standard

Amounts as publicly reported by data protection authorities and press coverage of the decisions. Sources: CNIL press releases (Sep 2025 Google & SHEIN, Nov 2025 Condé Nast, Jan 2026 American Express). This article is general information, not legal advice.

The three patterns behind almost every fine

Pattern 1: Cookies fire before the click

The SHEIN and American Express decisions share one core failure: tracking scripts ran before the visitor made any choice. This is called pre-consent tracking, and it is technically detectable by anyone who opens browser dev tools — which is exactly how many complaints start. Privacy advocacy groups now publish automated reports naming thousands of offending sites, so the complaint often arrives before the regulator's own scan does.

Pattern 2: Refusal is harder than acceptance

The CNIL's landmark decisions established that a banner where "Reject all" is smaller, greyed out, hidden behind a second menu, or simply missing is a dark pattern — even if a reject option technically exists somewhere. The 2026 standard is strict: equal prominence, equal number of clicks, first layer of the banner.

Pattern 3: The reject button doesn't work

The most expensive lesson from the SHEIN decision: having a CMP installed is not compliance. If cookies continue after rejection — through misconfigured tag managers, server-side tagging, or scripts outside the CMP's control — regulators treat it as knowing violation. CMP misconfiguration is now itself an audit finding that exposes every downstream client.

You don't need to be big to be investigated. Nine-figure fines make headlines, but most DPA activity targets ordinary business sites after a single user complaint. Even a four-figure penalty plus weeks of correspondence and mandatory documentation hurts far more than the minutes it takes to check your setup.

The 60-second self-check

  1. Open your site in an incognito window with dev tools open. If analytics, ad or social pixels fire before you touch the banner, you have pattern 1.
  2. Click "Reject all", then reload. Any new third-party cookies afterwards means pattern 3.
  3. Compare the buttons. Reject must be as visible and as easy as accept — same layer, same weight.
  4. Check consent logging. Under GDPR Article 7(1), you carry the burden of proof. No log = no valid consent.

Steps 1–2 are exactly what the free scanner automates — plus HTTPS hardening, security headers and privacy-policy linking:

Scan your site free →

If you find problems

Further reading