GDPR cookie fines: what regulators in the EU and the UK can impose

Which laws apply to cookies?

Two sets of rules apply at the same time, and both can lead to a fine.

• The cookie rule comes from article 5(3) of the ePrivacy Directive (2002/58/EC). Storing information on a device or reading it from there requires consent, unless it is strictly necessary for a service the user asked for. Each EU country has written this into its own law, and each country decides who enforces it and how high the fines are. More in EU cookie law explained.
• The GDPR applies as soon as cookies process personal data, which tracking and advertising cookies almost always do. It also sets the standard for valid consent: freely given, specific, informed and by a clear action.

Because the cookie rule is not part of the GDPR, the GDPR's one-stop-shop does not apply to it. A company with its EU headquarters in Ireland can still be fined by the French CNIL for cookies placed on French users' devices. The CNIL confirmed this in its decisions against Google and Shein, and the French Council of State upheld the CNIL's 2020 decision against Google in January 2022.

How high can the fines go?

Under the GDPR

Article 83 GDPR has two tiers:

Invalid cookie consent falls in the highest tier. These are maximums: the regulator sets the actual amount using the criteria in article 83(2), such as the nature, gravity and duration of the breach, the number of people affected, whether it was intentional or negligent, and what the company did to limit the damage.

Under national cookie laws

The maximums for the cookie rule itself differ per country. Two examples from the laws themselves: in Germany, a breach of § 25 TDDDG can lead to a fine of up to €300,000 (§ 28 TDDDG); in Spain, using cookies without the information or consent required by article 22.2 LSSI is a minor infringement with a fine of up to €30,000. In Italy, article 166 of the Codice privacy places breaches of the cookie article (article 122) in the highest GDPR tier. If personal data is processed, the GDPR fines can come on top.

The biggest cookie fines so far

The French CNIL has been by far the most active regulator on cookies. The table lists notable fines, all taken from the regulators' own publications:

In several of these cases the regulator also ordered the company to fix the problem within a set period (three or six months), with a penalty for every day of delay.

Not only big tech

The CNIL's list of sanctions shows many smaller fines as well: in 2024 and 2025, retailers, publishers, a travel agency and even a local authority were fined between €2,000 and €20,000 for cookie breaches, often under a simplified procedure. In 2025 alone, the CNIL sanctioned 21 organisations for breaches related to cookies and other trackers.

The UK: PECR fines after the Data (Use and Access) Act

In the UK, cookies fall under regulation 6 of PECR, enforced by the Information Commissioner's Office (ICO). Until recently the maximum PECR fine was £500,000. The Data (Use and Access) Act 2025 aligned PECR enforcement with the UK GDPR: since 5 February 2026, the ICO can fine up to £17.5 million or 4% of global annual turnover, whichever is higher.

So far, the ICO's cookie work has focused on getting websites to comply rather than on fines. In January 2025 it said it had assessed the top 200 UK websites and raised concerns with 134 of them; in April 2026 it said 99% of the top 1,000 websites now met its standards for cookie banners. Details in UK cookie law.

How enforcement works in practice

• Sweeps and scans. Regulators check large numbers of websites, often with automated tools, and then send warning letters or formal orders.
• Complaints. Many cases start with a complaint. The CNIL's 2025 Google case started with a complaint from the privacy organisation noyb.
• Orders before fines. Most regulators first ask you to comply. A fine usually follows when a company does not fix the problem, when the breach is serious or when many people are affected.
• Daily penalties. Orders often come with a penalty for every day the problem is not fixed, on top of the fine.

Other risks

Fines are not the only risk. Under article 82 GDPR, people can claim compensation for material or non-material damage. In Österreichische Post (C-300/21, 4 May 2023) the EU Court of Justice held that there is no threshold of seriousness, but that an infringement alone does not automatically mean damage. In some countries, such as Germany, consumer organisations can also take legal action over unlawful cookie banners.

How to stay out of trouble

The fines above come back to the same handful of mistakes:

1. No cookies before consent. Block every script that needs consent until the visitor agrees.
2. Rejecting as easy as accepting. Put "Reject all" on the first layer, as visible as "Accept all".
3. Clear information. Explain the purposes and name the third parties, in the banner and in a cookie policy.
4. Respect the choice. Stop reading and setting cookies once a visitor refuses or withdraws consent.
5. No forced consent. Be careful with cookie walls.
6. Keep proof. Record what each visitor chose and when.
7. Check regularly. New plugins and tags add cookies without anyone noticing.

Cookie Confirm takes care of these steps: the scanner checks your website every month (plus unlimited rescans), scripts stay blocked until consent, accept and reject sit side by side, the cookie declaration is generated from the scan and each consent is logged for 12 months. For €7.95 per website per month, with a 7-day free trial.

Sources

• EUR-Lex: Directive 2002/58/EC (ePrivacy Directive), article 5(3)
• EUR-Lex: Regulation (EU) 2016/679 (GDPR), articles 82 and 83
• CNIL: The sanctions issued by the CNIL
• CNIL: Council of State confirms the 2020 sanction against Google
• CNIL: Closure of the injunction issued against Facebook
• CNIL: Closure of the injunction issued against Microsoft Ireland Operations Limited
• CNIL: Advertisements inserted among emails, Orange fined €50 million
• CNIL: Google fined €325 million (September 2025)
• CNIL: Shein fined €150 million (September 2025)
• CNIL: Sanctions and corrective measures in 2025
• Autoriteit Persoonsgegevens: Fine of €600,000 for tracking cookies on Kruidvat.nl (16 July 2024, in Dutch)
• Autoriteit Persoonsgegevens: Decision on the objection of AS Watson (Kruidvat), 27 May 2025, in Dutch
• CJEU: Case C-300/21, Österreichische Post (4 May 2023)
• Gesetze im Internet: § 28 TDDDG
• BOE: Ley 34/2002 (LSSI), articles 22.2, 38 and 39
• Garante privacy: Codice in materia di protezione dei dati personali (article 166)
• UK Data Protection Act 2018, section 157 (maximum penalties)
• Data (Use and Access) Act 2025, section 115 and Schedule 13
• ICO: Statement on the commencement of the DUAA (February 2026)
• ICO: Action on cookie compliance across the UK's top 1,000 websites (January 2025)
• ICO: Final storage and access technologies guidance published (April 2026)