Cookies and consent
Cookie consent fines
Most cookie fines come down to three failures a scan can see: analytics or advertising tags that run before the visitor chooses, a banner that makes refusing harder than accepting, and choices that are not respected afterwards. In the United States the equivalent failure is ignoring an opt-out of sale or sharing, including Global Privacy Control.
These are the decisions where that was the finding.
Last checked . Amounts are in the original currency; conversions are approximate.
Fines
-
€345m about £295m
TikTok Technology Limited
The DPC found that TikTok set child users' accounts to public by default, let unverified adults pair with child accounts through Family Pairing, and did not explain these settings clearly to children in late 2020. A fairness finding was added at the EDPB's direction and TikTok was ordered to fix its processing within three months.
GDPR, Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(f), Art. 12(1), Art. 13(1)(e), Art. 24(1), Art. 25(1), Art. 25(2)
Read the DPC decision on TikTok Technology Limited -
€325m about £282m
Google LLC and Google Ireland Limited
The CNIL found that Gmail showed ads styled as emails in the Promotions and Social tabs without consent, and that the Google account sign-up flow steered users towards personalised ad cookies without making clear they were a condition of using the service. The total was split as 200 million euros for Google LLC and 125 million euros for Google Ireland.
French Data Protection Act art. 82 (ePrivacy); French Postal and Electronic Communications Code art. L.34-5, Art. 82 Loi Informatique et Libertés, Art. L.34-5 CPCE
Read the CNIL decision on Google LLC and Google Ireland Limited -
€150m about £130m
Infinite Styles Services Co. Limited (SHEIN)
The CNIL found that shein.com set advertising cookies as soon as visitors arrived, showed banners that did not explain the advertising purpose or name third parties, and kept setting and reading cookies after users clicked Reject all or withdrew consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Infinite Styles Services Co. Limited (SHEIN) -
€50m about £41.6m
Orange
The CNIL found that Orange displayed ads disguised as emails inside its webmail inboxes without consent, and that orange.fr kept reading previously set cookies after users withdrew consent.
French Data Protection Act art. 82 (ePrivacy); French Postal and Electronic Communications Code art. L.34-5, Art. 82 Loi Informatique et Libertés, Art. L.34-5 CPCE
Read the CNIL decision on Orange -
€10m about £8.69m
Yahoo EMEA Limited
The CNIL fined Yahoo for reading and writing advertising cookies without first collecting consent and for the way users could withdraw cookie consent. France's highest administrative court later rejected Yahoo's challenge and found the amount was not disproportionate.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Yahoo EMEA Limited -
€7m about £5.86m
Fnac Darty Participations et Services and Fnac Direct
The CNIL found the Fnac mobile app sent a user identifier and browsing activity to a third party domain via an API to power product recommendations and train the algorithm, even when users had not consented. It held that personalisation trackers of this kind are not exempt from consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Fnac Darty Participations et Services and Fnac Direct -
US$7m about £5.61m
Cerebral, Inc.
The FTC alleged the telehealth company exposed sensitive data of nearly 3.2 million people to LinkedIn, Snapchat, TikTok and others through tracking tools on its website and apps, and made cancelling difficult. The proposed order bans using or disclosing health data for advertising.
FTC Act s5 / ROSCA / Opioid Addiction Recovery Fraud Prevention Act
Read the FTC decision on Cerebral, Inc. -
US$2.75m about £2.01m
The Walt Disney Company
The Attorney General said Disney's opt outs, including Global Privacy Control signals, only covered one device or service while embedded third party ad tech kept receiving data. The settlement requires opt outs that stop sale and sharing across a logged in account.
CCPA
Read the CA-AG decision on The Walt Disney Company -
€1.5m about £1.31m
American Express Carte France
The CNIL found the French American Express website set advertising cookies before visitors made a choice, set them even after a refusal, and kept reading existing cookies after consent was withdrawn.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on American Express Carte France -
US$1.55m about £1.13m
Healthline Media LLC
The Attorney General said the health publisher kept sharing data with ad partners after users opted out, including via Global Privacy Control, shared article titles hinting at medical diagnoses for ad targeting, lacked required contracts, and ran a cookie banner that did not actually switch off tracking.
CCPA / Unfair Competition Law
Read the CA-AG decision on Healthline Media LLC -
US$1.2m about £1.02m
Sephora, Inc.
Landmark first CCPA settlement: the Attorney General said the retailer did not tell shoppers it was selling their data, ignored opt out signals sent through Global Privacy Control, and did not cure within 30 days.
CCPA
Read the CA-AG decision on Sephora, Inc. -
US$1.35m about £1m
Tractor Supply Company
The CPPA's largest fine to date: the agency said the retailer's website did not honour Global Privacy Control or offer an effective opt out, its consumer and job applicant privacy notices were inadequate, and it shared data without required contracts.
CCPA
Read the CPPA decision on Tractor Supply Company -
€750k about £661k
Les Publications Condé Nast (vanityfair.fr)
Despite an earlier order to comply, the CNIL found vanityfair.fr still set consent based cookies on arrival, labelled some cookies as strictly necessary without explaining them, and placed or read cookies after users refused or withdrew consent.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Les Publications Condé Nast (vanityfair.fr) -
US$633k about £489k
American Honda Motor Co.
The CPPA said Honda demanded identity verification and excess data for opt out requests, used a privacy choice tool that did not present options symmetrically, made it hard to use authorised agents, and shared data with ad tech firms without required contracts.
CCPA
Read the CPPA decision on American Honda Motor Co. -
US$345k about £258k
Todd Snyder, Inc.
The CPPA said the clothing retailer's misconfigured privacy portal left opt out requests unprocessed for 40 days, and that it asked for more information than needed and required identity verification before people could opt out.
CCPA
Read the CPPA decision on Todd Snyder, Inc. -
£140k about €163k
Grocery Delivery E-Services UK Ltd t/a HelloFresh
HelloFresh sent about 79 million marketing emails and 1 million texts relying on an opt-in that did not mention texts and was bundled with an age confirmation, and kept marketing to people for up to 24 months after they cancelled.
PECR, Reg. 22
Read the ICO decision on Grocery Delivery E-Services UK Ltd t/a HelloFresh -
€50k about £43k
AS Watson (Health & Beauty Continental Europe) B.V. (Kruidvat)
The AP found Kruidvat.nl tracked visitors with cookies without valid consent, using pre-ticked boxes and making refusal take many steps, which could reveal sensitive drugstore purchases. After the company's objection the AP cut the original 600,000 euro fine to 50,000 euros.
Proposed at €600k before the final decision.
GDPR (AVG)
Read the AP decision on AS Watson (Health & Beauty Continental Europe) B.V. (Kruidvat) -
€3,000 about £2,597
Wallapop, S.L.
The AEPD found es.wallapop.com used cookies before users consented, that Reject all did not stop them and that installed cookies could not be removed through the settings panel. The 5,000 euro proposed fine was cut by 40 percent to 3,000 euros after Wallapop admitted responsibility and paid early.
Proposed at €5,000 before the final decision.
Spanish LSSI art. 22.2 (ePrivacy), Art. 22.2 LSSI, Art. 38.4(g) LSSI
Read the AEPD decision on Wallapop, S.L.
Orders, reprimands and findings
-
Order or finding
Medmate Australia Pty Ltd
The Privacy Commissioner found that telehealth provider Medmate interfered with visitors' privacy by collecting sensitive health information through third-party tracking pixels used for social media ad targeting, without consent. The determination sets the position that pixel tracking on health websites is a collection of sensitive information that needs consent.
Privacy Act 1988 (Cth)
Read the OAIC decision on Medmate Australia Pty Ltd -
Order or finding
Monash IVF Pty Ltd
In a parallel determination, the Privacy Commissioner found that fertility clinic operator Monash IVF interfered with privacy by collecting sensitive information from website visitors via third-party tracking pixels without consent. The OAIC published a companion report on its inspection of 50 health service websites.
Privacy Act 1988 (Cth)
Read the OAIC decision on Monash IVF Pty Ltd -
Order or finding
Lower Saxony media company (not named by the regulator)
The Hannover administrative court upheld the regulator's order against a media company, ruling that a banner with Accept all on the first layer must offer an equally visible Reject all button. It also criticised repeated banner prompts, a misleading Accept and close button and hidden information on partners and third country transfers.
TDDDG s.25 and GDPR, § 25 TDDDG
Read the LfD-NI decision on Lower Saxony media company (not named by the regulator) -
Order or finding
Unnamed company (anonymised by the Garante)
The Garante found a website banner offered five unclear buttons with no indication of how to continue without non technical cookies, and reappeared on every visit. It issued a reprimand rather than a fine because the company fixed the banner during the proceedings.
GDPR; Italian Privacy Code art. 122 (ePrivacy); Garante cookie guidelines, Art. 4(11), Art. 5, Art. 7, Art. 12, Art. 13, Art. 24, Art. 25, Art. 122 Codice
Read the GPDP decision on Unnamed company (anonymised by the Garante) -
Order or finding
Several website publishers (not named)
After complaints, the CNIL ordered several publishers to fix cookie banners within one month where the reject option was a small or buried link, styled less prominently than accept, or worded vaguely while accept appeared several times.
French Data Protection Act art. 82 (ePrivacy), Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Several website publishers (not named) -
Order or finding
Bonne Terre Limited t/a Sky Betting and Gaming
Between January and March 2023 skybet.com placed 40 third-party marketing cookies before visitors made a choice in the consent banner, so their data reached adtech vendors without consent. The ICO issued a reprimand, not a fine.
UK GDPR, Art. 5(1)(a), Art. 6(1)(a), Art. 7(1)
Read the ICO decision on Bonne Terre Limited t/a Sky Betting and Gaming
Laws, deadlines and guidance
-
Law and guidance
Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs
The CNIL published its recommendation on session replay tools, stating they always need prior consent because no exemption applies, and asking providers and site owners to mask sensitive inputs and explain the tool on the first layer of the consent interface.
French Data Protection Act art. 82 (ePrivacy); GDPR data minimisation, Art. 82 Loi Informatique et Libertés
Read the CNIL decision on Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs -
Law and guidance
Les interfaces truquées : un obstacle à la protection des renseignements personnels
The CAI published a web page on deceptive design in digital services, warning that interfaces that steer people into sharing more data can invalidate their consent and make later use or disclosure of the data unlawful. The page covers types of dark patterns, legal obligations and good practice for organisations.
Quebec Private Sector Act
Read the CAI decision on Les interfaces truquées : un obstacle à la protection des renseignements personnels -
Law and guidance
Final storage and access technologies guidance published | ICO
The ICO issued final guidance on storage and access technologies, covering cookies, tracking pixels, fingerprinting and similar tools and reflecting the Data (Use and Access) Act changes. A separate review of the regulation 6 consent rule for online advertising was passed to government as advice in May 2026.
PECR / UK GDPR, Reg. 6
Read the ICO decision on Final storage and access technologies guidance published | ICO -
Law and guidance
The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026
From 5 February 2026 most UK GDPR and PECR reforms took effect, including recognised legitimate interests, new automated decision rules, revised rules on storing information on user devices and new PECR enforcement powers allowing fines up to the UK GDPR higher maximum of £17.5m or 4% of worldwide turnover. The duty to handle data subject complaints followed on 19 June 2026.
Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), DUAA s70, DUAA s80, DUAA s103, DUAA s112, DUAA s115, DUAA Sch 12, DUAA Sch 13, DPA 2018 s157
Read the DSIT decision on The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 -
Law and guidance
ICO action secures increased cookie compliance, giving millions stronger control over their personal information online | ICO
The ICO tested the UK's top 1,000 websites for ad cookies set before consent, rejecting being harder than accepting, and cookies set without consent; 979 passed at last test, 564 of them only after ICO letters, investigations or 17 preliminary enforcement notices. By April 2026 the ICO put compliance at 99%.
PECR, Reg. 6
Read the ICO decision on ICO action secures increased cookie compliance, giving millions stronger control over their personal information online | ICO -
Law and guidance
Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation (IP/25/2718)
The Commission proposed moving cookie rules for personal data into the GDPR, with one click refusal, choices respected for at least six months, browser level preference signals and no banner for low risk uses such as aggregated audience measurement. Breaches would carry GDPR level fines of up to 4 percent of global turnover.
Digital Omnibus proposal (amending GDPR and ePrivacy Directive)
Read the EC decision on Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation (IP/25/2718) -
Law and guidance
Report of the work undertaken by the Cookie Banner Taskforce
Landmark older item: EU authorities adopted a common report on cookie banner practices flagged by noyb complaints, which national regulators such as the CNIL now cite when judging reject buttons and deceptive designs.
ePrivacy Directive 2002/58/EC art. 5(3); GDPR
Read the EDPB decision on Report of the work undertaken by the Cookie Banner Taskforce
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.