GDPR5 min read
What cookie enforcement actions teach website owners
From the CNIL's fines against Google and Facebook to the Planet49 ruling, see which cookie consent mistakes regulators punish and how to check your own site.
Cookie enforcement keeps punishing the same few mistakes: making “reject” harder than “accept”, treating pre-ticked boxes or continued browsing as consent, and loading trackers before anyone has chosen. The clearest lessons come from the EU court’s Planet49 ruling and France’s 2021 fines against Google and Facebook. Fix those patterns and check your site the way a regulator would.
What happened in the CNIL’s Google and Facebook decisions?
In December 2021, France’s data protection authority, the CNIL, fined Google €150 million and Facebook €60 million. The core finding was simple: on their sites, accepting cookies took a single click, while refusing them took several.
The CNIL reasoned that this asymmetry steered people toward accepting, so the consent collected was not freely given. Nobody was forced to accept, but the path of least resistance led to yes, and that was enough. The regulator also ordered both companies to offer a way to refuse cookies that was as simple as accepting them.
The decisions also showed that cookie rules have their own enforcement route. The CNIL acted under French law implementing the ePrivacy Directive, rather than through the GDPR’s cross-border procedure, so it did not need to defer to a lead authority in another country.
The lesson: put a reject option on the first layer with the same prominence as accept. Our guide to cookie banner dark patterns covers the related design tricks regulators look for.
What did the Planet49 ruling settle?
In Planet49 (C-673/17, 2019), the Court of Justice of the EU (CJEU) ruled that a pre-ticked checkbox does not produce valid consent for cookies. The visitor has to take an active step.
The case involved an online promotional lottery in which a box allowing cookies was checked by default. The court held that consent requires active behavior, so leaving a default in place is not enough. It also confirmed that the consent requirement applies to information stored on the device whether or not it is personal data, and that users must be told how long cookies will operate and whether third parties can access them.
The lesson: start every non-essential category switched off, and make sure your banner or settings panel explains cookie lifetimes and third-party access.
What mistakes do regulators keep finding?
The same handful of problems appear again and again. Most of them are visible to anyone who opens a browser’s developer tools.
| Common mistake | Why it fails | What to do instead |
|---|---|---|
| No reject button on the first layer | Refusing is harder than accepting, so consent is not freely given | Show accept and reject side by side with equal prominence |
| Pre-ticked boxes or pre-enabled toggles | Not an active, unambiguous choice | Start every non-essential category switched off |
| Trackers firing on page load | Consent is not obtained before access | Block scripts until the relevant category is granted |
| “By using this site you agree” notices | Continued browsing is not an affirmative action | Require an explicit click to accept |
| Cookies still set after a refusal | The choice is recorded but not enforced | Test the reject path on every page template |
| Outdated cookie lists | Consent is not properly informed | Re-scan and update the policy when tags change |
| No easy way to withdraw | Withdrawing must be as easy as consenting | Keep a persistent link that reopens settings |
The third and fifth rows deserve emphasis. A well-designed banner offers no protection if the scripts behind it ignore the answer. Our guide on how to block third-party scripts until consent covers the technical side.
Why do national regulators act on cookies so often?
Cookie violations are easy to verify, easy to complain about and enforceable locally. That combination makes them a frequent target.
Because the ePrivacy rules are implemented in national law, a regulator can usually act against any site that serves people in its country, without the GDPR’s cross-border coordination. Our explainer on ePrivacy Directive vs. GDPR sets out why the two regimes are enforced differently.
Many investigations start with complaints from users or privacy advocacy groups, some of which have filed complaints in large batches against sites with non-compliant banners. Regulators also run their own sweeps and compliance campaigns. Evidence is simple to gather: a screenshot of the banner and a list of requests sent before any choice is made.
Penalties depend on the route. Under Article 83(5) of the GDPR, the most serious infringements can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher. Penalties under national ePrivacy laws follow each country’s own rules. Either way, regulators can also order changes, sometimes with deadlines attached.
How can you check your site the way a regulator would?
Load your site as a first-time visitor, record what happens before any click, then test every choice the banner offers. A basic check fits into a single working session.
- Start clean. Open a private browser window with developer tools on the Network and Application (or Storage) tabs.
- Load key pages without interacting. Check the homepage, a content page and a checkout or sign-up page, noting every cookie, local storage entry and third-party request.
- Flag anything non-essential. Analytics, advertising or social media requests at this stage are a problem.
- Count the clicks. Compare the effort needed to accept everything with the effort needed to reject everything.
- Reject and browse. Refuse all, then navigate and reload. No new non-essential cookies or requests should appear.
- Accept one category. Grant only analytics, for example, and confirm that only analytics tags load.
- Withdraw. Reopen the settings, revoke consent and confirm the affected tags stop.
- Compare and retrieve. Check that your cookie policy matches what you observed, and that you can find the consent record for your own test visit.
For a full inventory of everything your site sets, follow our guide on how to run a cookie audit.
Bottom line
Enforcement history is unusually consistent: regulators punish asymmetric choices, default-on consent and trackers that ignore the visitor’s answer. None of these is hard to detect, which is why they keep appearing in decisions. Tools like Cookiesh can run automated cookie scanning and keep hash-chained consent logs, but the most useful first step is a manual test of your own banner using the checklist above.
This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.
Frequently asked questions
Do regulators only go after big tech companies?
No. The largest fines make headlines, but regulators have also run broader compliance campaigns that sent warnings to many ordinary website operators. Many investigations start from user complaints, which any site can receive.
How do regulators find cookie violations?
Often through complaints from users or advocacy groups, and sometimes through their own website sweeps. Checking which cookies and requests a page sends before any choice is made takes only a browser, so violations are easy to document.
What should I do if I receive a regulator letter about cookies?
Respond within the stated deadline, document your current setup and fix clear problems promptly. Bring in a qualified privacy professional early, especially if the letter is a formal notice.
Are fines the only consequence of non-compliant cookies?
No. Regulators can also order you to change your banner or stop certain processing, sometimes with deadlines and daily penalties for delay. Published decisions can also damage trust with customers and partners.
Sources
Cookiesh Editorial Team
Privacy engineers and compliance specialists writing practical guidance on consent, cookies and data protection for product teams.
