The largest cookie consent fine of 2025 and 2026 so far is the EUR 325 million the CNIL imposed on Google on 1 September 2025, followed the same day by EUR 150 million on SHEIN. Both were French decisions under Article 82 of the French Data Protection Act, the national version of Article 5(3) of the ePrivacy Directive. As of October 2026, 2026 has brought smaller cookie fines, the closure of Google's injunction and higher maximum fines in the UK, but no decision on the 2025 scale.
Record cookie fines defined 2025
The year 2025 marked a turning point in cookie consent enforcement. The CNIL, France's data protection authority, issued 83 sanctions totalling EUR 486,839,500 across everything it enforces. Its 2025 enforcement summary names cookies as one of the main subjects: 21 organisations were sanctioned for breaching the rules on trackers, and the Google and SHEIN decisions alone account for EUR 475 million of the total. Across Europe, regulators sent a clear signal that cookie consent rules under Article 5(3) of the ePrivacy Directive are enforced, and the fines for ignoring them have grown.
This shift did not happen overnight. The CNIL has been escalating cookie-related penalties since 2020, and other European data protection authorities (DPAs) have followed. The scale of the 2025 fines is what set that year apart.
The biggest cookie fines of 2025
Enforcement actions from September to December 2025 dominated the headlines. Each targeted a different type of violation, but most shared a common thread: cookies placed before consent was given, and refusal mechanisms that did not work.
Google: EUR 325 million (CNIL, September 2025)
The CNIL fined Google EUR 325 million for two distinct violations. Google displayed advertisements between emails in Gmail inboxes without prior consent, and 53 million people in France saw them. During Google account creation, users were not validly informed that advertising cookies would be placed, a breach concerning more than 74 million accounts. The fine was split between Google LLC (EUR 200 million) and Google Ireland (EUR 125 million).
This was not Google's first CNIL cookie fine. The authority previously fined Google EUR 100 million in 2020 and EUR 150 million at the end of 2021. The trajectory is worth attention: repeated non-compliance leads to higher penalties.
SHEIN: EUR 150 million (CNIL, September 2025)
The CNIL fined SHEIN's Irish subsidiary, Infinite Styles Services Co. Limited, EUR 150 million after an August 2023 inspection found advertising cookies placed on visitors' devices as soon as they arrived on shein.com, before any interaction with the consent banner. The banner offered a "Reject all" button, but clicking it did not stop new cookies from being placed, and cookies already placed continued to be read after users withdrew consent.
The scale of the processing played a role in the amount: an average of 12 million people in France visited shein.com each month.
Information was also inadequate. The site showed two cookie interfaces, and neither said that cookies were used for advertising.
American Express: EUR 1.5 million (CNIL, November 2025)
A smaller but instructive case came on 27 November 2025, when the CNIL fined American Express Carte France EUR 1.5 million. Inspectors found three separate failures: advertising cookies placed before the user made any choice, cookies placed despite an explicit refusal, and cookies continuing to be read after the user withdrew consent. The investigation began with inspections in January 2023, a reminder that enforcement timelines can span years.
Two more in late 2025
On 20 November 2025 the CNIL fined Les Publications Condé Nast, publisher of vanityfair.fr, EUR 750,000 for cookies placed without consent, after inspections in 2023 and again in February 2025. On 30 December 2025 it fined an unnamed company EUR 3.5 million, mainly for passing loyalty-programme members' data to a social network for ad targeting, but also because eleven cookies requiring consent were placed before visitors made a choice and kept being read after a refusal.
Summary of major cookie fines in 2025 and 2026
| Organisation | DPA | Date | Fine (EUR) | Key violation |
|---|---|---|---|---|
| Google (Gmail ads, account cookies) | CNIL | 1 Sept 2025 | 325,000,000 | Ads without consent, invalid consent to ad cookies at sign-up |
| SHEIN | CNIL | 1 Sept 2025 | 150,000,000 | Cookies before consent, reject button that did not work |
| Unnamed company (loyalty data) | CNIL | 30 Dec 2025 | 3,500,000 | Data to a social network without consent, cookies before a choice |
| American Express | CNIL | 27 Nov 2025 | 1,500,000 | Cookies despite refusal, reading after withdrawal |
| vanityfair.fr publisher | CNIL | 20 Nov 2025 | 750,000 | Cookies placed without consent |
| Ticketing company | CNIL (simplified procedure) | 26 Mar 2026 | 15,000 | Cookie consent and cookie information, among other breaches |
CNIL cookie fines, September 2025 to March 2026
2026 so far: smaller fines and a closed injunction
As of October 2026, the CNIL's published list of 2026 sanctions, which runs to April 2026, holds one decision that names cookie consent: a EUR 15,000 fine on 26 March 2026 against a ticketing company, under the simplified procedure, for breaches that included cookie consent and cookie information. The large January 2026 fines, EUR 27 million against a mobile operator and EUR 15 million against a fixed-line operator, concerned data security and a breach, not cookies. The simplified procedure itself is a trend worth watching: 67 of the CNIL's 83 sanctions in 2025 went through it, and the CNIL's simplified sanction procedure reaches much smaller sites than the headline cases.
The Google case reached its next step on 23 September 2026. The CNIL closed the injunction it had issued alongside the fine, which carried a EUR 100,000-a-day penalty for delay. Google had added information at account creation saying that a Google account depends on placing advertising cookies, and had changed the format of Gmail ads so they are clearly distinct from real emails. The CNIL said the closure covers only the injunction and that it may check the whole account creation journey again.
Across the Channel, the UK's Information Commissioner's Office took a different approach. Rather than issuing fines, the ICO reviewed the UK's top 1,000 websites. By December 2025, 979 of them met its cookie checks, 564 of those only after the ICO had contacted them, and 17 had received preliminary enforcement notices.
The UK picture changed in 2026. Since 5 February 2026, the Data (Use and Access) Act 2025 lets the ICO fine breaches of the Privacy and Electronic Communications Regulations (PECR) up to GBP 17.5 million or 4 per cent of global turnover, in line with the UK GDPR, instead of the old GBP 500,000 cap.
Common violations behind the fines
Patterns repeat across nearly every enforcement action. Knowing these common failures is the most practical way to reduce your own risk.
Cookies firing before consent
The single most frequent violation is placing cookies, particularly advertising trackers like _fbp or _gcl_au, on the user's device before they interact with the consent banner. The SHEIN, American Express, vanityfair.fr and December 2025 cases all involved this issue. Under Article 5(3) of the ePrivacy Directive, storing or accessing information on a user's device requires prior consent unless the cookie is strictly necessary for the service requested.
Reject buttons that do not work
Offering a "Reject all" button that fails to block cookies is worse than not offering one at all, because it creates a false impression of user control. SHEIN's banner included a reject option, but new cookies were still placed after the user clicked it. This is a technical failure that regulators treat as a substantive consent violation.
Consent withdrawal ignored
Both the SHEIN and American Express cases revealed that cookies continued to be read after users withdrew their consent. Valid consent under GDPR Article 7 requires that withdrawing consent be as easy as giving it, and that withdrawal takes effect.
Dark patterns in consent interfaces
Google's fine partly stemmed from how the account creation journey presented advertising cookies. Dark patterns in cookie banners, such as hiding the reject option, using confusing language, or making acceptance visually prominent while burying refusal, have become a distinct enforcement target. The EDPB has published guidance making clear that consent obtained through manipulative design is not freely given.
What these fines mean for your website
You do not need to be a multinational retailer to face enforcement. The CNIL's simplified procedure handles smaller cases quickly, and complaint-driven investigations can target any website. The violations that attracted nine-figure fines against Google and SHEIN are technically identical to what happens on thousands of smaller sites every day.
Test your implementation, not just your banner
A consent banner only protects you if it actually controls cookie behaviour. Use browser developer tools to check that no marketing or analytics cookies fire before the user grants consent, after a refusal and after a withdrawal. Testing your banner should be a regular task, not a one-off during initial setup.
Audit third-party scripts regularly
Third-party tags are the most common source of pre-consent cookies. A marketing team adding a new tracking pixel can undo months of work. Run periodic cookie audits to catch scripts that bypass your consent mechanism, and use automated cookie scanning to detect changes between audits.
Document everything
If a DPA opens an investigation, your consent records and audit trail are your primary defence. Keep logs of when consent was given, what categories were accepted and when consent was withdrawn. Store scan results and banner configuration history.
Enforcement trends to watch in 2026
Several developments suggest that cookie enforcement will continue rather than plateau, in France and in the other jurisdictions that copy its approach.
The CNIL's action plan, running since 2019, continues to prioritise cookies. In the American Express decision it noted that the cookie rules are well known, given their long history and how widely the CNIL has published them, so organisations can no longer claim ignorance.
The Digital Omnibus proposal of November 2025 would move the EU cookie rules into the GDPR, but as of October 2026 it is still under negotiation. Until it is adopted, the current rules remain fully enforceable.
Cross-border coordination between DPAs is also growing. The December 2025 decision was adopted in cooperation with 16 European counterparts of the CNIL. The TikTok fine of EUR 530 million by Ireland's Data Protection Commission in May 2025, focused on data transfers rather than cookies, showed the scale of penalties the one-stop-shop mechanism can produce.
Repeat offenders face escalating penalties. Google's CNIL fines rose from EUR 100 million in 2020 to EUR 325 million in 2025. Organisations that fail to correct issues after a first sanction should expect substantially higher amounts next time.
Questions about cookie fines
What was the largest cookie consent fine in 2025?
The CNIL fined Google EUR 325 million on 1 September 2025, for showing advertisements between Gmail emails without consent and for placing advertising cookies at Google account creation without valid consent. As of October 2026, no 2026 cookie fine has come close.
Can small websites receive cookie consent fines?
Yes. DPAs can investigate any organisation that processes personal data, regardless of size. The CNIL's simplified procedure handled 67 of its 83 sanctions in 2025, and its 2026 list includes a EUR 15,000 fine that covered cookie consent.
What happens if my reject button does not actually block cookies?
Regulators treat a reject mechanism that does not work as a consent violation. Both the SHEIN and American Express fines involved cookies placed despite users refusing. Check that your consent mechanism technically prevents cookie placement when visitors decline.
How do I check if cookies fire before consent on my site?
Open your browser's developer tools, clear all cookies, then load your site without interacting with the consent banner. Check the Application and Network tabs for any non-essential cookies. Automated scanning tools can also detect cookies placed before consent.
Does the UK ICO fine websites for cookie violations?
The ICO has favoured engagement over fines for cookie violations, and its review of the top 1,000 UK websites led to 17 preliminary enforcement notices. Since 5 February 2026, its maximum PECR fine is GBP 17.5 million or 4 per cent of global turnover, up from GBP 500,000.
Which cookies require consent under the ePrivacy Directive?
All cookies require consent except those strictly necessary for the service the user explicitly requested. Analytics, marketing and personalisation cookies all need prior opt-in consent in the EU before they are placed on the user's device.
Check your banner for the faults behind these fines
Most of these decisions came down to cookies placed before a choice and refusals that did not hold. Kukie.io's GDPR compliance scanner opens one page the way a new visitor would and reports cookies and trackers set before any choice, a missing reject button and pre-ticked boxes.
