GDPR News Today — Cookie Consent Enforcement Updates (2026)
The latest GDPR enforcement actions, cookie consent rulings, and privacy regulation updates. This page is updated regularly — bookmark it for the most current privacy enforcement news.
April 2026
Enforcement Trends
The European Data Protection Board (EDPB) continues to coordinate enforcement across member states, with a particular focus on cookie consent and legitimate interest claims. Key themes in early 2026:
- Cookie consent enforcement expanding — National DPAs are moving beyond large tech companies to audit mid-market websites and e-commerce platforms
- Google Consent Mode v2 compliance — DPAs have signaled that improperly implemented GCM v2 does not satisfy consent requirements
- Cross-border enforcement streamlining — The EDPB's new dispute resolution procedures are reducing case backlogs
What This Means for Your Website
If you operate a website with EU visitors, these enforcement trends have practical implications:
- Your CMP configuration matters. Having a consent banner installed isn't enough — it must actually block tracking before consent. Scan your site to verify.
- Google Consent Mode must be properly implemented. Simply adding the GCM snippet doesn't guarantee compliance if the default consent state allows tracking.
- Mid-market sites are now targets. The era of "only big companies get fined" is over.
How GDPR Cookie Enforcement Works
Understanding how DPAs enforce cookie rules helps you anticipate and avoid violations:
Who Enforces
Each EU member state has its own Data Protection Authority (DPA):
- France: CNIL — historically the most active on cookie enforcement
- Ireland: DPC — handles cases for companies headquartered in Ireland (Meta, Google, etc.)
- Italy: Garante — active on cookie consent and marketing rules
- Spain: AEPD — active enforcement, especially on consent banners
- Germany: State-level DPAs plus the BfDI at federal level
The EDPB coordinates cross-border cases and issues binding guidance.
What Triggers an Investigation
- Complaints from individuals — anyone can file a complaint with a DPA
- Coordinated sweep actions — DPAs periodically audit websites in specific sectors
- NGO complaints — organizations like noyb file systematic complaints across borders
- Media attention — high-profile data breaches or privacy scandals prompt investigations
Fine Calculation
GDPR fines can reach up to 4% of global annual revenue or 20 million euros, whichever is higher. Factors that influence the amount:
- Severity and duration of the violation
- Number of affected individuals
- Whether the violation was intentional or negligent
- What the company did to mitigate the damage
- History of previous violations
For cookie consent violations specifically, fines have ranged from a few thousand euros for small sites to hundreds of millions for major platforms.
Notable Cookie Enforcement Cases
CNIL Cookie Enforcement (France)
France's CNIL has been the most aggressive enforcer on cookies. Notable cases include:
- Fined Google 150 million euros and Facebook 60 million euros (2022) for making cookie rejection harder than acceptance
- Fined Microsoft 60 million euros (2022) for setting advertising cookies without consent on bing.com
- Issued hundreds of smaller fines to French websites for pre-consent tracking
CNIL's enforcement principle: rejecting cookies must be as easy as accepting them. Dark patterns in cookie banners — like hiding the reject button in settings — trigger enforcement.
ICO Cookie Guidance (UK)
The UK's ICO has taken a softer approach, preferring guidance over fines for cookie issues. However, their November 2024 guidance update made clear:
- Analytics cookies are not strictly necessary and require consent
- Cookie walls (blocking content until consent) are not compliant
- Consent must be freely given — pre-selected checkboxes don't count
noyb Cookie Complaints
The privacy NGO noyb (led by Max Schrems) has filed over 800 cookie-related complaints across Europe since 2021. Their targets include:
- Websites with "Accept All" but no equally prominent reject option
- Cookie banners that default to all categories selected
- Sites that ignore reject signals and continue tracking
Staying Compliant: Practical Steps
Based on current enforcement trends:
- Audit your website regularly — new scripts get added, CMP configurations change, and compliance can break silently
- Ensure reject is as easy as accept — CNIL's enforcement makes this clear
- Implement Google Consent Mode v2 correctly — check your GCM implementation with a free scan
- Document your consent mechanism — if audited, you'll need to demonstrate how consent works
- Monitor enforcement in your key markets — a fine in France signals what other DPAs will follow
Resources
- Scan your website for GDPR compliance — free, 60-second audit
- Compliance Index — see how websites across industries score on cookie compliance
- EDPB official site — binding guidance and cross-border decisions
- CNIL cookie guidance — the standard for cookie enforcement
- ICO cookie guidance — UK-specific rules
This page is updated regularly with the latest GDPR enforcement actions and cookie consent news. Last updated: April 2026.