France's data protection authority, the CNIL, fined Google EUR 325 million and Shein EUR 150 million in September 2025, a combined EUR 475 million in a single week, for placing advertising cookies on users' devices before they had made a consent choice. It is the largest cookie-specific enforcement action anywhere in Europe to date, and it capped a six-year run of escalating CNIL cookie fines that has made France the continent's most aggressive cookie regulator.
Cookie enforcement is not evenly spread across the EU. Some national authorities issue frequent, large fines specifically for cookie-banner violations; others fold cookie issues into broader GDPR cases without a separately published figure. Below is a country-by-country look at who has actually fined whom for cookies, how the amounts compare, and what changed for enforcement risk heading into 2026.
Which country fines the most for cookie violations?
France's CNIL is, by a wide margin, the most active cookie-specific enforcer in Europe. Since December 2020, it has issued four separate rounds of cookie fines against major platforms: Google and Amazon in 2020, Google and Facebook in 2022, and Google and Shein in 2025, totaling roughly EUR 820 million. No other national authority has published a comparable run of cookie-specific fines at this scale; Spain's AEPD and Italy's Garante issue large numbers of GDPR cases overall, but neither publishes a separate cookie-only running total the way CNIL does.
Figure 1: CNIL's six largest cookie consent fines, ranked by amount. Source: CNIL press releases, 2020 to 2025.
What are the biggest cookie fines ever issued?
Every fine below was issued specifically for cookie consent practices, not general GDPR processing violations, which is why this table differs from broader GDPR fine rankings.
| Company | Fine | Regulator | Date |
|---|---|---|---|
| EUR 325 million | CNIL (France) | September 2025 | |
| Shein | EUR 150 million | CNIL (France) | September 2025 |
| EUR 150 million | CNIL (France) | December 2021 | |
| EUR 100 million | CNIL (France) | December 2020 | |
| Facebook Ireland | EUR 60 million | CNIL (France) | December 2021 |
| Amazon Europe | EUR 35 million | CNIL (France) | December 2020 |
Every case on this list shares the same underlying violation: cookies placed, or a reject option buried, before the user made a real choice. The Google and Amazon 2020 cases were the first to establish that CNIL would treat pre-consent advertising cookies as a standalone, separately fineable offense under France's Data Protection Act rather than folding it into a general GDPR case.
How has CNIL's cookie enforcement evolved since 2019?
CNIL's cookie enforcement did not start with a single large fine. It began as a stated action plan and escalated in five distinct steps over six years.
Figure 2: Six years of escalating CNIL cookie enforcement. Source: CNIL press releases and EDPB Cookie Banner Taskforce Report (January 2023).
The pattern across every wave is the same complaint category: cookies deployed before a valid opt-in, or a banner design that makes accepting easier than rejecting. CNIL's own guidance has not changed the underlying rule since 2020; what has changed is the size of the fines applied to repeat and first-time offenders alike.
What triggers a cookie fine under the ePrivacy Directive?
The EDPB's Cookie Banner Taskforce Report, adopted in January 2023 and coordinated across all 30 of the EEA's national data protection authorities, found that a "vast majority" of authorities treat a missing or harder-to-use reject option as a clear breach of Article 5(3) of the ePrivacy Directive. The report also flagged pre-ticked consent boxes and banners that make withdrawing consent harder than giving it.
Figure 3: The compliance test national authorities apply to a cookie banner. Source: EDPB Cookie Banner Taskforce Report, January 2023.
Every fine in the country table above traces back to one of these three failure points. A privacy policy and cookie banner that document your legal basis clearly and make rejection genuinely equal to acceptance address the exact criteria regulators check first; you can generate a GDPR-ready privacy policy that covers the consent and disclosure language these enforcement actions test for.
How concentrated was CNIL's 2025 enforcement in these two cases?
CNIL issued 83 total sanctions in 2025, worth roughly EUR 486.8 million combined. The Google and Shein cookie fines alone, EUR 475 million of that total, accounted for an estimated 97.6% of the year's entire sanction value, leaving the other 81 cases to share the remaining 2.4%.
Figure 4: Share of CNIL's 2025 total sanction value from the two headline cookie fines. Calculated from CNIL's reported 2025 totals; treat the 97.6% figure as a derived estimate, not a CNIL-published percentage.
That concentration illustrates something important about reading cookie enforcement statistics: a handful of nine-figure fines against large platforms can dominate a regulator's annual total, while the median cookie case, often against a smaller company, settles for a fraction of that amount and rarely makes headlines.
How does the UK's new PECR fine cap change cookie enforcement risk?
Cookie rules in the UK sit under the Privacy and Electronic Communications Regulations (PECR), not UK GDPR directly, and PECR's fine cap was capped at GBP 500,000 for years, far below GDPR-level penalties. That changed on 5 February 2026, when the core provisions of the Data (Use and Access) Act 2025 took effect and raised the PECR maximum to GBP 17.5 million or 4% of global annual turnover, whichever is higher, aligning cookie-law risk with UK GDPR for the first time. The Act also removed the prior requirement to prove a breach caused substantial damage or distress before a fine could be issued, lowering the bar for enforcement.
The Bottom Line
Cookie enforcement in Europe is not spread evenly: France's CNIL accounts for nearly every nine-figure cookie fine on record, and its EUR 475 million week in September 2025 alone exceeded most countries' entire cumulative GDPR enforcement history. The violation pattern behind every fine in this tracker is consistent and predictable, cookies placed before consent, or a reject option that is harder to use than accept, which means the fix is also consistent: a compliant banner and a privacy policy that documents legal basis and consent mechanics clearly. With the UK's PECR cap now matching GDPR-level exposure and CNIL continuing to fine smaller companies like American Express in 2026, cookie compliance risk is no longer limited to platforms the size of Google.
Frequently Asked Questions
What is the biggest cookie consent fine ever issued? The EUR 325 million fine against Google, issued by France's CNIL in September 2025 for placing advertising cookies before users consented, is the largest single cookie-specific fine on record. Issued the same week as a EUR 150 million fine against Shein, the two penalties totaled EUR 475 million.
Which country fines the most for cookie violations? France, through its data protection authority CNIL, has issued more cookie-specific fines than any other EU country, with at least EUR 820 million in cookie enforcement actions against Google, Amazon, Facebook, and Shein since December 2020.
Has the UK increased cookie law fines? Yes. The UK's Data (Use and Access) Act 2025 raised the maximum PECR cookie-law fine from GBP 500,000 to GBP 17.5 million or 4% of global turnover, effective 5 February 2026, aligning cookie penalties with UK GDPR for the first time.
What makes a cookie banner non-compliant under EU rules? Per the EDPB's Cookie Banner Taskforce Report, coordinated across the EEA's national data protection authorities in January 2023, the most common violation is a missing or harder-to-find reject option, since a vast majority of authorities treat unequal accept/reject buttons as a breach of Article 5(3) of the ePrivacy Directive.
Where the Numbers Come From
- CNIL. (2025). "Cookie regulation: the CNIL is continuing the action plan initiated in 2019 and has imposed two fines on SHEIN and GOOGLE." Google fined EUR 325 million, Shein fined EUR 150 million, September 2025.
- CNIL. (2025). "Cookies placed without consent: SHEIN fined 150 million euros by the CNIL." 1 September 2025.
- DLA Piper Privacy Matters. (2022). "France: Cookies, new record sanctions for tech giants, CNIL fines Facebook Ireland 60 million euros and Google 150 million euros." Decision dated 31 December 2021.
- France 24. (2020). "French watchdog fines Google EUR100m and Amazon EUR35m for cookie breaches." 10 December 2020.
- European Data Protection Board. (2023). "Report of the Work Undertaken by the Cookie Banner Taskforce." Adopted 17-18 January 2023.
- DLA Piper Privacy Matters. (2026). "UK: Commencement of the data protection provisions in the Data (Use and Access) Act." PECR cap raised to GBP 17.5 million, effective 5 February 2026.
- Uniconsent. (2026). "GDPR Enforcement and Fines 2026: Business Categories, Top Cases, and Country." CNIL's 2025 total of 83 sanctions and EUR 486.8 million, and France's cumulative total passing EUR 1 billion, are figures aggregated by this source rather than a single CNIL-published table; treat them as a secondary estimate.
Note: All figures verified as of September 2026. The CNIL 2025 sanction total and the 97.6% concentration figure in this post are derived estimates based on aggregated third-party reporting rather than a CNIL-published breakdown, and will be refreshed alongside CNIL's next annual activity report.
