Cookie banner fines in 2026: who was fined, how much and why

Cookie fines are no longer rare events reserved for the largest platforms. Since September 2025, the French CNIL alone has fined Google €325 million, Shein €150 million, Condé Nast €750,000 and American Express €1.5 million for cookie violations, published a €3.5 million decision that included eleven cookies placed before any choice, and issued 23 smaller sanctions under its simplified procedure between January and July 2026, several of them for banners where accepting took one click and refusing took a detour. The reasons are the same five, year after year.

The fines, verified

The table lists decisions where cookies or trackers were the reason or a main reason, with the amounts and dates as published by the authority. Companies are named where the authority named them; the CNIL removes names from its published decisions after a period, so some older entries are confirmed through its list of sanctions and the Légifrance text.

Two things stand out. Cookie fines are decided under the national law that transposes the ePrivacy Directive (article 82 of the French Data Protection Act in France), not under the GDPR's one-stop shop, so a French authority can fine a company headquartered in Ireland or China for its French visitors. And the US cases show the same failure in a different legal model: the opt-out model asks less, but it still requires that refusing be as easy as accepting and that it work.

The five reasons that repeat

1. Cookies before the choice

Shein, American Express, Condé Nast and the unnamed €3.5 million case all placed cookies "as soon as users arrived on the site, even before they interacted with the information banner", in the CNIL's words about Shein. It is the easiest violation to detect from outside: open the site in a fresh browser and look. The fix is to block scripts until consent, not to add a banner over scripts that already fired.

2. Refusing is harder than accepting

Google and Facebook (2021), Microsoft and TikTok (2022), and a share of the 2026 simplified sanctions: one click to accept, a settings screen to refuse. The CNIL's guidelines of September 2020 require refusing to be as easy as accepting, and the EDPB's cookie banner taskforce agreed in 2023 that a banner with an accept button and no reject option on the same layer is an infringement for a vast majority of authorities. See the Reject all guide.

3. Refusal or withdrawal does not actually stop anything

Yahoo (at least twenty advertising cookies without prior consent, and a withdrawal that cost users their mailbox), Orange (cookies still read after withdrawal, "even if this data is not subsequently used"), American Express and Condé Nast. A reject button that does not disconnect the tags is treated as the absence of a reject button.

4. Vague information and false "essential" labels

TikTok's first layer gave "only a general and approximate description of the purposes"; Condé Nast presented cookies as strictly necessary without useful information. The taskforce report noted that website owners must be able to demonstrate why each cookie they call essential really is.

5. No proof of consent

The 2023 €40 million decision against the advertising company rested on article 7(1) GDPR: it could not demonstrate that visitors to its partners' sites had consented to its tracker, and a contract clause requiring partners to collect consent was not enough. Consent records are not paperwork; they are the defence.

Who gets fined

The headline amounts go to large platforms because fines are scaled to turnover and audience, but the simplified procedure shows the other end: a ticketing company fined €15,000 on 26 March 2026, retailers, publishers, a local authority and a travel agency fined between €2,000 and €20,000 in late 2025, all for cookies. Nineteen of the 23 simplified sanctions of January to July 2026 followed complaints. Anyone can file one, and the CNIL's investigators start by loading the site in a fresh browser.

What this means for your site

The compliance test an authority applies is short and technical: before any click, does the site set only necessary cookies? After Reject all, is that still true? After withdrawal, do the old cookies stop being read? Does the banner show Reject all next to Accept all? Can you produce the consent record for a given visit? If the answer to all five is yes, the banner design debates become secondary. The cookie audit checklist walks through the test; a scan of your own site with the free cookie scanner shows what loads before consent on up to five pages, without an account. The regulators' expectations behind these fines are explained in our article on the CNIL guidelines and the EDPB taskforce report.