85% of EU and UK websites run a cookie banner that fails GDPR's minimum bar for valid consent, according to Aarhus University's CHI 2025 study, which tested 254,148 websites in August and September 2024. Only 15% met the study's definition of minimally compliant: an accept and a reject option shown with equal visual prominence, and no cookie category pre-selected by default.
That compliance gap is not just an academic finding. It is the exact legal test that six national data protection authorities have used to issue real fines, from a few thousand euros against a Spanish airline to hundreds of millions against Google, and the same test the European Data Protection Board wrote into its own enforcement guidance. Below is what "invalid consent" actually means under GDPR, how widespread the defect is, and the specific EU case data behind the fines it has triggered.
What percentage of cookie banners fail GDPR's consent test?
85% of the 254,148 EU and UK websites Aarhus University researchers tested failed to meet the minimum bar for valid consent, and the individual defects behind that number are specific and repeatable. Only 45% of consent interfaces offered a reject option anywhere, compared with 88% that offered an accept option, meaning a large share of banners let a user say yes in one click while offering no equivalent way to say no.
Figure 1: Share of sites meeting the minimum bar for valid consent, equal accept/reject prominence, no pre-ticked boxes. Source: Aarhus University, "A Cross-Country Analysis of GDPR Cookie Banners," CHI 2025, 254,148 sites tested August-September 2024.
Compliance also varies sharply by country, which points to inconsistent enforcement pressure rather than a technical limitation. Spain's top websites had the highest compliance rate in the study at 28%, while Slovenia's sat at just 3%, a nine-fold gap between two EU member states operating under the same regulation.
| Country | Share of sites minimally compliant |
|---|---|
| Spain | 28% |
| Slovakia | 25% |
| Italy | 23% |
| Bulgaria | 4% |
| Slovenia | 3% |
Table: Compliance rate by country, ranked. Source: Aarhus University, CHI 2025.
This gap between what a banner shows and what actually counts as consent is also why acceptance rates vary so widely from one country to the next; see the full breakdown of cookie acceptance rates and enforcement costs for how that plays out beyond the compliance test alone.
What specifically makes cookie consent invalid under GDPR?
GDPR consent is only valid if it is freely given, specific, informed, and given through a clear affirmative action, per Article 4(11) and Article 7. The European Data Protection Board's Cookie Banner Taskforce, formed after Max Schrems' privacy group noyb filed hundreds of cookie-banner complaints across EU member states, published a consolidated report in January 2023 confirming which specific banner designs fail that test.
Figure 2: The validity test national authorities apply to a cookie banner, based on the EDPB Cookie Banner Taskforce's consolidated position. Source: European Data Protection Board, Cookie Banner Taskforce Report, January 2023.
The Taskforce report itself grew out of an earlier, disclosed-sample review: noyb's May 2021 sweep of 560 EU websites across 33 countries found that 81% offered no reject option on the banner's first layer and 90% gave no easy way to withdraw consent once given. That 2021 figure is now five years old and should be read as the historical baseline that produced the EDPB's guidance rather than a current compliance rate, but the 2024-2025 case data below shows regulators are still finding, and fining, the same defects noyb first documented at scale.
Do websites actually honor a rejection?
Not consistently, and this is a separate failure from the banner's design. ETH Zurich researchers tested 100,000 websites for their USENIX Security paper, "Automated Large-Scale Analysis of Cookie Notice Compliance," and found that 65% of the sites they were able to test kept tracking users after those users had clicked reject. A compliant-looking banner with a working reject button is not proof that refusal actually stops data collection on the back end, which is exactly the second defect CNIL cited against Google in its September 2025 decision. It also helps explain why so few users bother going past the default choice at all; see what share of users actually change their cookie settings once they realize the default click may not be respected.
Which EU regulators have fined companies for invalid consent?
At least four national data protection authorities, France's CNIL, Italy's Garante, Belgium's Data Protection Authority, and Spain's AEPD, have issued fines that explicitly name one or more of the defects above as the reason. France's CNIL has been the most aggressive enforcer by fine value, but the smaller cases in Italy and Spain show the same legal test applied to companies with no comparable ad-tech scale.
Figure 3: Nine named invalid-consent decisions across four EU countries, 2020-2025. Source: CNIL, Belgian Data Protection Authority, Garante, AEPD press releases and decisions, as cited in Where the Numbers Come From below.
Summed together, the cases documented in this article alone total roughly EUR 820.57 million in fines tied directly to invalid cookie consent, and that total only counts decisions with a publicly confirmed euro amount, not the full universe of cookie enforcement across the EU.
Figure 4: Running total of the named cases in this article's timeline, not a complete EU tally. Source: figures as cited per case above.
If your site runs any third-party advertising or analytics script, the underlying fix is the same regardless of country: a clear, accurate description of what each cookie does and why, which is exactly what a current privacy policy built for your actual cookie use documents alongside your consent banner's own settings.
Figure 5: Count of named decisions per country covered in this article, not a complete national case count. Source: as cited per case above.
| Country | Regulator, company (year) | Fine | Consent defect cited |
|---|---|---|---|
| France | CNIL, Google (2020) | EUR 100M | Cookies placed on google.fr before any user consent |
| France | CNIL, Amazon (2020) | EUR 35M | Same defect, on amazon.fr |
| France | CNIL, Google (2021) | EUR 150M | Refusing cookies took 5+ clicks versus 1 to accept |
| France | CNIL, Facebook (2021) | EUR 60M | Refuse button mislabeled and buried on a second page |
| Belgium | APD/Market Court, IAB Europe (2022/2025) | EUR 250K | Consent-logging framework has no valid legal basis |
| Italy | Garante, Ediscom SpA (2023) | EUR 300K | First Garante case classifying a dark-pattern banner as a GDPR violation |
| Spain | AEPD, SEAT (2024) | EUR 20K (reduced to EUR 12K) | Cookies loaded at session start, no working reject mechanism |
| France | CNIL, Google (2025) | EUR 325M | Cookies before choice, tracking continued after refusal |
| France | CNIL, SHEIN (2025) | EUR 150M | Same category of defect |
Table: Named invalid-consent decisions by country, largest French cases and one representative case per other country. Fine amounts as confirmed by each regulator; see Where the Numbers Come From for full citations.
For most sites, fixing these defects means either rebuilding the banner logic in-house or buying a dedicated consent management platform; see what a consent management platform actually costs before assuming the enterprise-only vendors are the only option.
The Bottom Line
The EU's 85% non-compliance rate and its growing list of nine-figure fines describe the same underlying problem from two different angles: a cookie banner that makes accepting easier than refusing, that pre-selects consent, or that keeps tracking after a user says no, does not produce valid consent under GDPR, regardless of how polished the banner looks. The fines above range from EUR 20,000 to EUR 325 million, which tells its own story: regulators in Spain and Italy are willing to act on the same defect at a small e-commerce company that CNIL fines at nine figures against Google, so company size does not determine whether the underlying banner logic gets scrutinized. If you are configuring a cookie banner and the site's own privacy disclosures alongside it, matching what the banner says to what your policy discloses is the detail every one of these decisions turned on.
Frequently Asked Questions
What percentage of cookie banners are not GDPR compliant? 85% fail GDPR's minimum bar for valid consent, per Aarhus University's CHI 2025 study of 254,148 EU and UK websites tested in August and September 2024. Only 15% offered an accept and reject option that were equally prominent with no pre-checked boxes, the study's definition of minimal compliance.
What specifically makes cookie consent legally invalid under GDPR? Four defects recur across enforcement cases and the EDPB's own Cookie Banner Taskforce report (January 2023): no reject option on the same layer as accept, pre-ticked consent boxes, dark-pattern designs that make refusal harder to find than acceptance, and cookies that load before a user makes any choice or that keep loading after a user refuses.
What is the biggest fine issued for invalid cookie consent? France's CNIL fined Google LLC and Google Ireland Limited EUR 325 million on 1 September 2025 for placing cookies before users made a choice and continuing to track some users after they refused. CNIL fined SHEIN's parent, Infinite Styles Services, EUR 150 million the same day for similar defects.
Do websites actually honor a reject-all click? Not consistently. 65% of the 100,000 websites ETH Zurich researchers tested in their USENIX Security study continued tracking users who had explicitly clicked reject, according to the paper "Automated Large-Scale Analysis of Cookie Notice Compliance," published in 2023.
Where the Numbers Come From
- Aarhus University (Nouwens, Kristensen, Maalt, Bagge). "A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them." Accepted to CHI 2025. 254,148 websites tested across 31 EEA/UK countries, data collected 12 August to 4 September 2024.
- European Data Protection Board. "Report of the Work Undertaken by the Cookie Banner Taskforce." Published 18 January 2023.
- noyb.eu. "noyb Aims to End 'Cookie Banner Terror' and Issues More Than 500 GDPR Complaints." 31 May 2021. 560 websites reviewed across 33 countries.
- Zac, Bouhoula, Kubicek, Cotrini, Basin (ETH Zurich). "Automated Large-Scale Analysis of Cookie Notice Compliance." USENIX Security 2023. 100,000 websites tested.
- CNIL. Sanctions against Google (EUR 100 million) and Amazon Europe Core (EUR 35 million), 7 December 2020, for placing cookies without prior consent.
- DLA Piper Privacy Matters, reporting CNIL's decisions of 31 December 2021 fining Google EUR 150 million and Facebook Ireland EUR 60 million for making cookie refusal harder than acceptance.
- Belgian Data Protection Authority. Market Court ruling upholding the EUR 250,000 fine against IAB Europe over its Transparency and Consent Framework, May 2025 (original APD decision February 2022).
- GDPRhub. Garante per la protezione dei dati personali (Italy), decision 9870014, Ediscom S.p.A., EUR 300,000 fine for dark-pattern cookie banner design, 23 February 2023.
- DataGuidance, reporting AEPD proceeding PS/00284/2024 fining SEAT SA EUR 20,000 (reduced to EUR 12,000), 5 November 2024, for cookies placed without prior consent and no working reject mechanism.
- CNIL. "Cookies and Advertisements Inserted Between Emails: Google Fined 325 Million Euros by the CNIL." 1 September 2025.
Note: All figures verified as of September 2026. The cumulative EUR 820.57 million figure in this article is a sum of the named, individually sourced cases listed above, not an official published total, and does not represent all invalid-consent enforcement across the EU. Figures are refreshed at least twice a year to track new decisions and compliance studies.
