Introduction
2025 was the year cookie enforcement stopped being theoretical. France’s CNIL issued 83 sanctions totalling roughly €486.8 million the bulk tied to cookies and ad trackers – and fined Google €325M and Shein €150M on a single day in September. Across the Atlantic, California regulators passed $9 million in cumulative fines with a string of settlements against household names. Every one of these cases traces back to a handful of repeatable mistakes. Here they are, with the price tags attached.
Mistake #1: Trackers Fire Before Consent
The price: €150,000,000. The CNIL’s September 2025 fine against Shein centered on advertising cookies set on page load, before the user had interacted with the banner at all. Analyses of published DPA decisions consistently show pre-consent tag firing – not banner wording – as the most-cited cookie violation, and the CNIL runs a dedicated “cookie squad” performing automated sweeps of high-traffic sites.
Why it happens: the banner is a UI layered over tags that were never actually gated. GA4 fires on GTM’s “All Pages” trigger, the Meta Pixel is hardcoded in the theme, a caching plugin reorders scripts. The banner renders; the damage is already done.
The fix: network-level script blocking with denied-by-default consent state, then verification in DevTools a fresh visit must show zero non-essential cookies and no tracker requests before interaction.
Mistake #2: No Real “Reject” Option (Dark Patterns)
The price: €325,000,000. Google’s record CNIL fine stemmed partly from consent design that steered users toward accepting personalized advertising during account creation – alongside inserting ads into Gmail inboxes without consent. Repeat offenses compounded it: Google’s CNIL cookie fines escalated from €100M in 2020 to €325M in 2025, a warning that regulators multiply penalties for recidivism.
Dark patterns now under explicit fire: a missing first-layer “Reject All,” reject options buried in second-layer settings, confusing double negatives, and accept buttons styled to dominate. The EDPB has stated plainly that consent obtained through manipulative design is not freely given. The Dutch DPA warned 200+ websites over banner design and fined retailer Kruidvat €600K for pre-ticked boxes.
The fix: symmetric first-layer choices – Accept All and Reject All, equal prominence, honest copy.
Mistake #3: Withdrawal and Opt-Outs That Don’t Actually Work
The price: fines on two continents. Both the Shein and American Express cases found cookies still being read after users withdrew consent – GDPR Article 7 requires withdrawal to be as easy as consent, and to take technical effect. In the US, the Todd Snyder settlement involved a misconfigured consent banner that silently prevented consumers from opting out for an extended period. Nobody intended it; the malfunction itself was the violation.
The fix: test the full lifecycle – grant, withdraw, verify trackers stop and cookies clear – and monitor continuously. A consent system, like any system, breaks silently when the site around it changes.
Mistake #4: Ignoring (or Half-Honoring) GPC Signals
The price: $2,750,000. Disney’s settlement with California regulators found the company restricted Global Privacy Control signals to individual devices, even when users were logged into their accounts — the signal must be honored across your entire data stack for known users. Around a dozen states now mandate GPC recognition, Firefox and Brave send it by default, and in late 2025 California, Colorado, and Connecticut ran a coordinated GPC sweep.
Why it happens: detection at the edge without propagation. The CMP reads the header; the tag manager, server-side event pipeline, and CDP never hear about it – three separate failures regulators can test independently.
The fix: wire GPC into the same consent state that drives everything else, and since 1 January 2026, show California visitors visible confirmation that their signal was honored – full setup in our Do Not Sell page guide.
Mistake #5: Policy Says One Thing, the Site Does Another
The price: the theme behind California’s $9M+ enforcement wave. Cases including Healthline and PlayOn Sports share a signature: the privacy policy and banner described controls that the technical implementation didn’t deliver. Regulators’ new standard is network evidence – they load your site with an opt-out active and document every identifier that still transmits to ad partners. As one 2026 enforcement summary put it: “consent collected” is not the standard; “consent enforced” is.
The fix: periodic runtime audits comparing declared behavior against actual network traffic – the same test the regulator will run, performed by you first. For the complete requirements baseline, see the ultimate guide to cookie consent in 2026.
Mistake #6: Stale Cookie Inventories and Misclassified Cookies
Marketing teams ship new pixels monthly; consent configurations don’t update themselves. Misclassified cookies (an ad tracker filed under “necessary”) and unscanned additions are cited across DPA decisions and are among the most common findings in compliance scans. Sites drift out of compliance – they rarely start there.
The fix: automated recurring scans with alerts when new, uncategorized trackers appear, and a rule that no new marketing tag ships without a category assignment.
Mistake #7: No Proof of Consent
Under GDPR the burden of proof is yours. In audits and complaint investigations, the inability to produce consent records – who, when, which categories, which banner version – converts a defensible position into a violation. US enforcement is heading the same way: California’s 2025–2026 framework demands documented risk assessments and auditable evidence that opt-outs propagate.
The fix: immutable, timestamped consent logs retained for the life of the consent (CookieLet’s Premium plan keeps five years).
The 2026 Enforcement Landscape at a Glance
| Regulator / Case | Amount | Core failure |
| CNIL → Google (Sept 2025) | €325M | Ads without consent; manipulative consent design |
| CNIL → Shein (Sept 2025) | €150M | Pre-consent cookies; broken Reject All; withdrawal ineffective |
| CNIL → Free Mobile / Free (Jan 2026) | €27M / €15M | Broader data-protection failures – sustained enforcement appetite |
| Dutch DPA → Kruidvat | €600K | Pre-ticked consent boxes |
| California → Disney | $2.75M | GPC honored per-device only, not across logged-in users |
| California → Todd Snyder | $345K | Misconfigured banner blocked opt-outs |
| UK ICO | Compliance-first | Top-1,000-site review; 95%+ compliant by Dec 2025 – but DUAA 2025 raised max PECR fines to £17.5M / 4% of turnover |
Three trends worth internalizing: enforcement is reaching mid-market companies, not just Big Tech (CNIL and Spain’s AEPD have both fined mid-market firms in the past 18 months); repeat violations escalate sharply; and state AGs are coordinating – Connecticut alone ran five privacy-notice sweeps and two cookie-banner sweeps, while Oregon issued 38 cure letters in 2025.
The 15-Minute Self-Audit
- Fresh incognito visit, DevTools open: any non-essential cookies or tracker requests before you click? Fail.
- First layer of your banner: is Reject as easy as Accept? If not, fail.
- Click Reject, browse three pages: anything firing to Google/Meta/TikTok? Fail.
- Accept, then withdraw via your preferences link: do trackers stop? Is withdrawal one click, not five?
- Enable GPC (Firefox/Brave), revisit: does your site detect it, suppress sharing, and confirm visibly?
- Ask your team for last month’s consent logs. If nobody knows where they are, that’s your answer.
The Economics
Every failure above is preventable with tooling that costs a rounding error against exposure. Compliance analyses put prevention at well under 0.1% of potential fine exposure and that’s before counting the operational orders that accompany fines: forced redesigns, mandated audits, and regulator supervision that lasts years.
Frequently Asked Questions
Increasingly, yes. DPAs sanction mid-market companies, complaint-driven investigations target any site, automated sweep tooling makes small-site checks cheap, and US state AGs mail cure letters by the dozen. Rhode Island’s new law even removed the cure period entirely.
Prior blocking with denied-by-default consent state it addresses the most-fined violation (pre-consent firing) and mechanically prevents several others. Second: a fresh audit if your EU setup predates October 2024 (EDPB Guidelines 2/2023 final) or September 2025 (the CNIL fines that reset enforcement expectations).
Sometimes the ICO’s top-1,000 program and many state AG cure letters lead with engagement. But no-cure jurisdictions exist, repeat findings skip straight to penalties, and even a “friendly” cure letter costs real legal fees and remediation time.
Continuously via automated consent monitoring, with a human review quarterly and after any significant site, tag, or CMP change. Most violations in 2025–2026 case files are drift, not design.
Catch the mistakes before regulators do
CookieLet’s scanner and consent monitor continuously verify that nothing fires before consent, opt-outs actually work, and GPC is honored with audit-ready logs to prove it.
