The cookie-fine map, 2026: who is being fined, for what, and how far down-market enforcement has reached

For most of the last decade, "cookie fine" meant one regulator (the CNIL) and a handful of American platforms. That is no longer accurate. In 2025 the CNIL issued 83 sanctions, 21 of them for cookie and tracker failures. In the first half of 2026 it added 23 simplified-procedure sanctions against fast-food chains, transport operators, ticketing firms, law practices and medical offices, many for cookie banners. The UK ICO swept its top 1,000 sites. California's regulator and Attorney General settled four cases in a year, each involving a banner or opt-out that did not do what it appeared to do. Spain's AEPD keeps fining companies nobody outside their sector has heard of.

This article is a map: what has been enforced, by whom, for which technical behaviours, and at what cost. Amounts and dates come from regulator publications where they exist and from named legal or trade summaries where they do not. The point is the pattern of what gets checked, because that is what a marketing team can act on.

The behaviours that get fined

Across seven jurisdictions, the findings repeat. In rough order of frequency:

1. Tags or cookies set before any interaction with the banner. The most common finding, and the easiest to detect automatically.
2. "Reject" that does not work. Cookies still set, or still read, after refusal.
3. Asymmetric banners. One click to accept, several to refuse, or no first-layer reject.
4. Continued reading after withdrawal.
5. Information gaps. Purposes not stated, third parties not named, policy out of date.
6. Opt-out signals ignored (US): Global Privacy Control not honoured; "Do Not Sell" forms that do nothing.

The EDPB's cookie banner taskforce report of January 2023 set the common EU position on most of these: first-layer reject, no pre-ticked boxes, no deceptive button design, withdrawal as easy as consent. National regulators have been enforcing it since.

The map

Each row links to its source; rows from trade or law-firm summaries rather than the regulator's page are identifiable by the link. Where a decision was reduced on appeal, both figures are shown.

Reading the map

France is the volume regulator, and the volume is moving down-market

The headline fines get the coverage, but the CNIL's 2025 report shows the shape of the machine: 67 of 83 sanctions went through the simplified procedure, a fast track created in 2022 with a €20,000 cap. Cookie failures are a standing category in it. The July 2026 batch describes the typical finding in one sentence: a single-click "accept all" alongside a "customise" path that takes several clicks to refuse, "contrary to legal consent requirements". Restaurants, station retailers and medical practices are not the audience of enterprise privacy software. They are the audience of a web agency.

An average simplified fine of under €6,000 will not frighten a large company. It arrives, though, with a public decision, a compliance order and legal fees, and for a small business it is the most expensive thing its website has ever done.

Spain proves the floor is low

The AEPD's 2025 cookie decisions are small (€1,600 to €3,000) and the companies are mid-sized or smaller. The findings are what matter: cookies before action, reject buttons that do not work, cookies persisting after rejection, the same three behaviours the CNIL found at SHEIN. Enforcement is behaviour-based; size only sets the amount.

Italy: warnings first, then email pixels

The Garante's 2025 cookie decisions ended in warnings and admonishments rather than fines, in one case because the company fixed the banner before the decision. The findings (ambiguous buttons, cookies set regardless of the choice, banners re-shown on every visit) are a checklist of dark patterns. In 2026 the Garante turned to email tracking pixels, covered in our companion piece on the CNIL's July deadline.

The Netherlands: appeals cut the fine, not the record

Kruidvat's €600,000 fine became €50,000 on appeal, the AP citing the length of its own procedure, the company's admission, and a lower assessment of severity. The published decision and a year of proceedings did not shrink with it.

Germany enforces through courts and sweeps

Germany's contribution is a court ruling: the Hanover Administrative Court upheld an order that a site offering "accept all" must offer an equally prominent "reject all". Bavaria's authority ran an automated sweep of roughly 350 sites for pre-consent cookies and missing reject buttons. Regulators' tooling is converging on auditors' tooling.

The UK went from letters to a much larger stick

The ICO's top-1,000 sweep produced no fines but 564 letters and 17 preliminary enforcement notices, plus a promise to re-test. Then the law changed. From 5 February 2026, the Data (Use and Access) Act 2025 raised the maximum PECR penalty from £500,000 to £17.5 million or 4% of worldwide turnover, the UK GDPR ceiling. The ICO's May 2026 guidance requires "accept all" and "reject all" with equal prominence and states that advertising and affiliate pixels cannot rely on any exemption. The 2024 reprimand of a gambling site for cookies deployed before the pop-up was the ICO working around a £500,000 cap. It no longer needs to.

California enforces the opt-out, and tests it

The four California actions differ in legal basis (opt-out rather than opt-in) but not in method: the regulator tested the mechanism and found it did nothing. Healthline's banner "did not effectively" disable advertising cookies; Tractor Supply's "Do Not Sell" form did not effectuate the choice; Honda's banner was one click to accept and toggle-by-toggle to refuse; Todd Snyder's banner vanished for forty days and nobody noticed because nobody was monitoring it. Global Privacy Control featured in all four.

What "down-market" means in practice

Enforcement now reaches: any site with meaningful French traffic, whether or not it is French (SHEIN was fined via ePrivacy jurisdiction over French users); any site in the UK's top 1,000, which the ICO will re-test; any Spanish company that receives a complaint, at fine levels that make defending uneconomic; any site in California's reach with a broken opt-out; and any small French business sampled into the simplified procedure.

The common denominator is not size. It is that the behaviour is observable: pre-consent requests, non-functional rejects and ignored signals show up in a browser session that a regulator, a complainant or a scanner can run in minutes. Enforcement has become cheap to produce, and cheap enforcement scales downward.

The corollary is that the check is cheap too. The three states a regulator tests (no interaction, reject, accept) are the three TagPatrol replays with a real browser across every page in a report. The free scan at tagpatrol.app runs one page in one consent state and shows the first five findings. If your site sells into any market on this map, it is a reasonable first step.

Written by TagPatrol's AI content team and reviewed under human direction.