The European Accessibility Act (EAA) has applied since 28 June 2025, and it treats your cookie banner as part of the service it sits in front of. If that service is in scope - an online shop, a consumer banking app, an e-book platform - the banner must be operable by keyboard, readable by screen readers and perceivable at sufficient contrast, or you're breaking EU law on two fronts at once.
Key Takeaways
The EAA, Directive (EU) 2019/882, has applied since 28 June 2025 and covers cookie banners as part of in-scope digital services such as e-commerce and consumer banking.
The transition period running to 2030 protects pre-existing service contracts and self-service terminals, not live websites or apps.
EN 301 549 v3.2.1, which incorporates the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, is the practical technical benchmark; a WCAG 2.2 version is expected to be cited in the Official Journal in late 2026.
Penalties sit at member-state level: up to EUR 100,000 per violation in Germany, up to EUR 60,000 and possible imprisonment in Ireland, tiered fines up to EUR 1,000,000 in Spain.
A banner that keyboard or screen reader users can't operate also undermines consent under the General Data Protection Regulation (GDPR), which must be freely given, specific, informed and unambiguous.
What Is the European Accessibility Act?
The European Accessibility Act is Directive (EU) 2019/882, an EU law that sets accessibility requirements for a defined list of consumer-facing products and services. It has applied across all member states since 28 June 2025, and it exists to give roughly 87 million people with disabilities in the EU equal access to digital services.
The in-scope services matter here. They include e-commerce services - any website or app that lets consumers conclude a contract at a distance, which catches most online stores - along with consumer banking, e-books and e-readers, audiovisual media services, electronic communications, and parts of passenger transport. Unlike the Web Accessibility Directive, which covers public sector bodies, the EAA reaches private companies, including non-EU companies selling to EU consumers.
There's one carve-out worth knowing. Microenterprises that provide services - fewer than 10 staff with annual turnover or balance sheet totals of no more than EUR 2 million - are exempt from the service requirements. Anything larger carries the obligations in full.
Does the EAA Apply to Your Cookie Banner?
Yes, wherever the underlying service is in scope. The directive never names cookie banners, but its Annex I requires the user interface of an in-scope service to be perceivable, operable, understandable and robust - and a consent banner is usually the first interactive element a visitor meets. If someone can't get past it, they can't use the service at all.
That gatekeeper position is what makes banners such an obvious audit target. A blocking overlay that a screen reader never announces doesn't merely fail one checkpoint; it renders the entire site unusable for a blind visitor. A reject control rendered as pale grey text on white fails visitors with low vision. A banner built from click-handling <div> elements instead of real buttons is invisible to keyboard navigation entirely.
These are functional failures under Annex I, and they stopped being a design debate on 28 June 2025.
Which Deadlines and Transition Periods Apply?
The core date has already passed: products placed on the market and services provided to consumers from 28 June 2025 must comply. The transition rules that run to 2030 are narrower than most summaries suggest - they protect pre-existing service contracts and installed self-service terminals, not live websites or apps.
| Date | What it covers | What it means for your site |
|---|---|---|
| 28 June 2025 | In-scope services, including websites and apps | A consumer-facing service operating after this date is expected to comply now |
| 28 June 2030 | Service contracts concluded before 28 June 2025 | Existing contracts may run unchanged until expiry, but no later than this date |
| Up to 20 years | Self-service terminals lawfully in use before 28 June 2025 | Installed terminals may serve out their economic life |
The practical takeaway: a cookie banner shown today on an in-scope service has no grace period. The fact that a site launched before 2025 protects nothing about the interface it serves now.
Why an Inaccessible Banner Can Invalidate GDPR Consent
Consent under the GDPR must be freely given, specific, informed and unambiguous, and Article 7(3) requires withdrawing it to be as easy as giving it. A visitor who can't perceive the choices or reach the reject control can't give valid consent - so every non-essential cookie you set on that visit lacks a legal basis under the ePrivacy Directive, which demands consent before anything non-essential touches the device.
This is where accessibility failures and consent failures converge. France's data protection authority (CNIL) fined SHEIN EUR 150 million in September 2025 for placing advertising cookies before consent, for incomplete banners and for ignoring users' choices. An inaccessible banner produces the same outcomes by a different route: choices that can't be exercised, information that can't be perceived. Regulators already treat dark patterns in consent interfaces as invalidating, and an interface that only a sighted mouse user can operate sits uncomfortably close to that category.
The exposure is double. A market surveillance authority can act on the accessibility breach while a data protection authority acts on the invalid consent - two regulators, one banner. Recent cookie consent fines show authorities testing how banners actually behave, and the baseline GDPR cookie consent requirements assume an interface every visitor can use.
Which Accessibility Standard Applies to Cookie Banners?
The EAA states functional requirements rather than naming a web standard, and as of July 2026 no harmonised standard has been cited under it in the Official Journal of the European Union. In practice, authorities benchmark digital services against EN 301 549 v3.2.1, whose web chapter incorporates WCAG 2.1 Level AA. That makes WCAG 2.1 AA the working floor for a compliant banner.
The standard is moving, though. A draft revision, v4.1.0, went out for review in November 2025, and the finalised v4.1.1 - which incorporates WCAG 2.2 Level AA - is expected to be cited in the Official Journal around October 2026. WCAG 2.2 is backwards-compatible with 2.1, so building to it today creates no conflict and covers the new criteria on focus appearance, target size and dragging movements before they become the reference point. The WCAG 2.2 success criteria that apply to cookie banners are worth reviewing now rather than next year.
What Do You Need to Fix on Your Banner?
Most banner failures cluster around five things: keyboard access, focus management, screen reader semantics, contrast and timing. Fix those on both the first layer and the preferences layer and you've covered the bulk of what EN 301 549 asks of a consent interface.
Full keyboard operation. Every control - accept, reject, settings, each category toggle - must be reachable and activatable with Tab and Enter, with a visible focus indicator at every stop.
Screen reader semantics. The banner should announce itself as a dialog with a proper accessible name, toggles should expose their on/off state, and buttons should be real
<button>elements rather than styled<div>s with click handlers.Contrast and zoom. Text needs a 4.5:1 contrast ratio against its background, and the layout has to reflow at 200% zoom instead of clipping the reject option off-screen.
No time pressure. A banner must not auto-dismiss or treat silence as acceptance after a countdown; consent given under timing pressure fails on both laws.
An accessible second layer. The preference centre and the withdrawal control need the same treatment - Article 7(3) makes an unreachable withdraw button a GDPR problem as well as an accessibility one.
For working code - focus traps, ARIA wiring, restoring focus when the dialog closes - follow the developer guide to accessible cookie banner implementation. If you use a consent management platform, check what its banner renders out of the box and what your customisations change; a hand-edited template with a low-contrast reject link can undo an otherwise accessible widget.
Who Enforces the EAA and What Are the Penalties?
Enforcement sits with national market surveillance authorities, and Article 30 of the directive leaves penalty levels to each member state - so your exposure depends on where your visitors are, not where you're based. One year in, several authorities have moved from building capacity to active investigation.
| Member state | Transposition | Maximum penalty |
|---|---|---|
| Germany | Accessibility Strengthening Act (BFSG) | EUR 100,000 per violation |
| Ireland | Irish EAA regulations (2023) | EUR 60,000 and/or up to 18 months imprisonment |
| Spain | Ley 11/2023 | Tiered fines up to EUR 1,000,000 |
| Netherlands | Sector regulators led by the Authority for Consumers and Markets (ACM) | Fines available; none issued under the EAA as of mid-2026 |
The first year produced real activity. In France, disability organisations sent formal notices to major retailers on 7 July 2025 and filed for emergency injunctions that November - the first private EAA court actions. In Germany, online shops began receiving competitor cease-and-desist letters (Abmahnungen) built on accessibility gaps within weeks of the deadline. In the Netherlands, an ACM investigation found that, as of March 2026, 61% of the largest Dutch online retailers didn't meet EAA requirements, largely because visitors with disabilities couldn't complete an order unaided.
As of July 2026, no headline EAA fine has landed on a cookie banner alone. The banner still sits in the audit path of every one of these investigations, because it's the first screen an auditor or a complainant meets.
Frequently Asked Questions
Does the European Accessibility Act apply to all websites?
No. It covers defined services such as e-commerce, consumer banking, electronic communications, e-books and audiovisual media, and it exempts microenterprises that provide services. Most sites selling to EU consumers are in scope, and accessible consent remains good practice for everyone else.
Is my existing website covered by the EAA transition period until 2030?
Almost certainly not. The transition to 28 June 2030 protects service contracts concluded before 28 June 2025 and self-service terminals already in use, not live websites or apps. A consumer-facing site operating today is expected to comply now.
Which WCAG version does the European Accessibility Act require?
The EAA doesn't name one. Authorities benchmark against EN 301 549 v3.2.1, which incorporates WCAG 2.1 Level AA, and an updated version incorporating WCAG 2.2 AA is expected to be cited in the Official Journal in late 2026. Building to WCAG 2.2 AA now covers both.
Can an inaccessible cookie banner invalidate GDPR consent?
Yes, and that's the practical risk: GDPR consent must be informed and unambiguous, and withdrawal must be as easy as giving it. A visitor who can't perceive or operate the banner can't meet those conditions, so cookies set on that basis lack a valid legal ground.
What are the penalties for an inaccessible cookie banner?
They're set nationally: up to EUR 100,000 per violation in Germany, up to EUR 60,000 and possible imprisonment in Ireland, and tiered fines up to EUR 1,000,000 in Spain. A data protection authority can separately sanction the invalid consent under GDPR and ePrivacy rules.
Make Your Consent Banner Work for Every Visitor
If your site serves EU consumers, your consent banner is now judged on accessibility as well as on what it says. Kukie.io gives you a banner you can restyle for contrast and test with a keyboard before you ship it, and a scanner that shows which cookies fire before consent.
