The CNIL simplified procedure explained: what a €5,800 fine looks like

Tuesday's map of cookie enforcement is full of nine-figure numbers: SHEIN at €150M, Google at €325M. Those cases are real, but they are not what most cookie enforcement looks like. In 2025 the CNIL issued 83 sanctions, and 67 of them went through a mechanism most site owners have never heard of: the procédure simplifiée, or simplified procedure. Since January 2026 it has produced 23 more sanctions totalling €133,750, an average of about €5,800 per decision. This is what that number is, and what it means for a site too small to ever appear in a headline.

What the simplified procedure is

The CNIL created the simplified procedure in 2022 to deal with a rising caseload — over 12,000 complaints in 2022 alone. It exists for cases that present no particular legal difficulty: the facts are clear, the breach is straightforward, and a full contested hearing would be disproportionate.

The mechanics are the point. Under the ordinary procedure, the CNIL's restricted committee (formation restreinte) deliberates and can fine in the tens or hundreds of millions. Under the simplified procedure, a single member — the president of the restricted formation, or another member acting alone — decides the sanction. The ceiling is fixed: a simplified sanction cannot exceed €20,000. And critically, the CNIL cannot disclose the identity of the sanctioned organisation. That is a legal constraint, not a courtesy: the published decision list identifies each case by sector and violation type, never by name.

That is why the simplified procedure is nearly invisible in coverage of "cookie fines." A €325M CNIL decision against Google gets a wire story. A €5,000 decision against an unnamed regional retailer gets a line on a CNIL webpage that almost nobody reads, and nothing else.

What €5,800 actually represents

The €5,800 figure is not a single fine — it is the average of the 23 decisions the CNIL published between January and early July 2026: €133,750 across 23 cases works out to roughly €5,815 per decision. Individual amounts inside that batch vary by violation and by how the organisation responded to the CNIL's initial notice, and the CNIL's own published list does not break out a per-decision figure specifically for cookies in this batch — checked directly, not assumed. So this piece uses the batch average, not an invented example.

What the batch does break down is subject matter: of the 23, 19 originated from a complaint filed with the CNIL, and the topics split across video surveillance (excessive filming of employees), cookies (incomplete banner information or non-compliant consent mechanisms), rights non-compliance (8 cases, mostly ignored access or erasure requests) and defective cooperation with the CNIL (4 cases, usually alongside a rights complaint). Among the cookie cases, the CNIL restated a rule it has been enforcing consistently since 2020: if a site lets a visitor accept all cookies in one click, it must let them refuse all in one click too. That is the single most common finding behind the small, unnamed fines in this batch, and it is a one-line check on any banner.

Why this matters more than the headline fines

The nine-figure cases are what get written about, but they are outliers by construction: they require a company large enough, and a violation clear enough, to justify a full contested procedure. The simplified procedure is where the CNIL's volume enforcement actually happens — complaint-driven, fast, capped at €20,000, and never named. For a site that is not Google or SHEIN, a cookie complaint is statistically far more likely to end as one of these anonymous €5,800-average decisions than as a headline.

The practical takeaway is unglamorous but concrete: the check that triggers most of these fines — does "reject all" work in one click, the same as "accept all" — is the cheapest thing on a compliance checklist to verify, and the most commonly skipped. A free scan at tagpatrol.app runs that exact check, and four others, on one page in under a minute.

Written by TagPatrol's AI content team and reviewed under human direction.