Are cookie consent rules really being enforced?

Yes, and increasingly against the technical behaviour of the site rather than the wording of the banner. In 2025 the French regulator CNIL sanctioned 21 organisations for tracker breaches, including two fines of 325 and 150 million euros in September 2025, and its 83 sanctions for the year totalled almost 487 million euros. In the UK, the ICO checked the 1,000 most visited websites and reported in December 2025 that 979 now pass, after letters, investigations and 17 preliminary enforcement notices.

What do regulators actually test?

The same things an automated check tests: whether tags send data and set cookies before the visitor chooses, whether rejecting is as easy as accepting on the first layer, whether consent can be withdrawn, and whether a refusal is honoured. Banner wording matters less than what the browser does.

Does Google Consent Mode v2 make me compliant?

No. It makes Google's own tags respect the visitor's choice, and it is required by Google for EEA advertisers since March 2024 if you want audiences, remarketing and conversion modelling. The law is about every tag and every cookie, so Meta, LinkedIn, Microsoft and the rest still need to be gated.

Is the EU about to replace cookie banners with browser signals?

Not yet. The Commission's Digital Omnibus proposal of November 2025 included browser or device signals as a way to express consent, the Council dropped that article from its position in June 2026, and as of October 2026 member states had not agreed a mandate. Until a new law is adopted, the GDPR and the ePrivacy Directive apply as they are.

What is the quickest way to know where my site stands?

Load it in a clean browser from the EU and watch what fires before you click, then accept and watch again. The free Website Consent Checker does exactly that and exports the findings as a PDF for your developer.

Cookie Consent Enforcement in 2026: Fines Are Up and the Excuses Are Gone

For a decade, cookie consent was treated as a wording problem. Put up a banner, link to a policy, mention cookies, move on. That period is over. Between 2023 and 2026 the European and UK regulators moved from guidance to sanctions, and the sanctions are about what the site does: which tags fire before the visitor chooses, which cookies land, and whether refusing is a real option. This article is a map of where enforcement stands in October 2026, what is being tested, and how to make sure your own site passes.

France: from recommendations to hundreds of millions

The CNIL has been the most active regulator on trackers for years, and 2025 was its biggest year. In its summary of the year it reports 259 corrective decisions, including 83 sanctions totalling 486,839,500 euros, and 21 organisations sanctioned specifically for breaches of the rules on cookies and other trackers: trackers stored without consent, information too unclear for consent to be informed, refusals and withdrawals not honoured. The two largest fines of the year, 325 million and 150 million euros in September 2025, were both cookie cases, widely reported as Google and Shein. Compliance orders also went to websites that did not let visitors refuse cookies as easily as accept them, and to sites that ignored a withdrawal of consent.

Two things stand out in the French approach. First, the technical test comes before any argument about wording: investigators load the site and look at what is set before any click. Second, since 2025 the CNIL has paid particular attention to what happens after a refusal or a withdrawal. A site that honours "accept" but keeps tracking after "reject" is treated as if it had no banner at all.

United Kingdom: a thousand websites, one question

The ICO took a different route: a campaign rather than a headline fine. It started in November 2023 by writing to the operators of the UK's most visited websites, giving them 30 days to make sure visitors could reject advertising cookies as easily as accept them. By January 2024 most of the first batch had changed their banners. The campaign then widened to the top 1,000 sites, with a second wave of letters setting a January 2025 deadline, investigations where letters did not work, and 17 preliminary enforcement notices.

In December 2025 the ICO reported the result: 979 of the top 1,000 websites met its compliance checks, 564 of them after failing first and being contacted, and action continued against the 21 that still failed. It also credited changes made by the consent management platforms that serve nearly 80% of the top 500 sites, which now ship compliant banner options by default. Along the way, in September 2024, the ICO took action against Sky Betting and Gaming for using advertising cookies without consent, as a reminder that there are consequences.

The ICO's position is simple and public: a reject button as prominent as accept, at the point where consent is asked, and no non-essential cookies set until the visitor has chosen. Under PECR the fine can reach 500,000 pounds; under the UK GDPR, 17.5 million pounds or 4% of global turnover.

The rest of Europe: the same checklist everywhere

The EDPB's cookie banner taskforce, set up after hundreds of complaints filed by noyb, published its findings in January 2023, and national regulators have applied them since: no pre-ticked boxes (which the Court of Justice had already ruled invalid in Planet49 in 2019), a reject option on the first layer, no deceptive button design, no "legitimate interest" switches that are on by default, and an easy way to withdraw. Spain's AEPD updated its cookie guide so that from January 2024 rejecting must be possible at the same level as accepting. Italy's Garante has required a clear reject option since its 2021 guidelines. Austria, Belgium, the Netherlands and the Nordics have all issued decisions on sites that set cookies before consent or hid the refusal.

The pattern is the point. Whatever the country, the test is the same four questions: does anything track before the choice, can the visitor refuse as easily as accept, is the refusal honoured, and can the choice be changed later.

Google's own rules: Consent Mode v2

Regulators are not the only enforcers. Since March 2024 Google requires advertisers with EEA traffic to pass consent signals to its platforms under the EU user consent policy, through Consent Mode v2 with its two added signals, ad_user_data and ad_personalization. Without them, audiences, remarketing and Customer Match stop working for European visitors, and conversion measurement loses its modelling. Google enforces this through its own checks of the signals it receives rather than through declarations, and in 2026 it has continued to tie more of the Ads and Analytics data flow to these signals.

This is a business consequence rather than a legal one, but it has done more to make sites implement consent properly than any fine. It also creates a trap: a site with Consent Mode v2 configured perfectly for Google can still fire the Meta Pixel and the LinkedIn Insight Tag before consent, because those tags never read Google's signals. Only tag-level gating in Google Tag Manager closes that gap.

The reform that has not arrived

In November 2025 the European Commission proposed, as part of its Digital Omnibus package, that cookie and tracking preferences could be expressed once through a browser or device signal that websites would have to respect, which would have removed most banners. By June 2026 the Council had dropped that article from its position, after several member states objected, and in September and October 2026 the presidency's revised texts and a failed Coreper vote left the question open. Privacy groups published detailed critiques of the package; industry groups asked for the browser signal back.

The practical conclusion for a website owner is unglamorous: nothing has changed yet. The GDPR and the ePrivacy Directive apply as they are, the regulators are testing the same four questions, and the sites being fined in 2026 are being fined under the rules that existed in 2020.

What this means for your site

Treat consent as a technical property of the page, not a page of text. The checklist regulators use is short:

Nothing tracks before the choice. No analytics or advertising hits, no tracking cookies, until the visitor accepts. Google's cookieless pings under Consent Mode are the accepted exception.
Reject is as easy as accept. On the first layer, same size, same colour weight, same number of clicks.
Refusal is honoured. After "reject", still nothing tracks. This is where the CNIL now looks first.
The choice can be changed. A visible way to reopen the banner, and withdrawal that actually stops the tags.
Google Consent Mode v2 is in place if you run Google Ads or GA4: all four signals denied by default, set before Google Tag Manager loads, and updated from the banner.

The first, second and fifth points are what the free Website Consent Checker tests: it loads your page in a real browser from Amsterdam, records what fires before anyone touches the banner, reads the live Consent Mode state, clicks accept and records again. The result is six checks and an exportable PDF with the exact fixes, which is usually the fastest way to get an agency or a developer to act. Our companion guide, how to check if your website tracks before consent, walks through the manual version and the four failures behind most results.

If you are setting tracking up now, start consent-aware. TrackingCoder generates Google Tag Manager containers with Consent Mode v2 built in, so GA4, Google Ads, Meta, LinkedIn and Microsoft tags wait for the visitor's choice from the first publish. Then check the live site, keep the report, and check again after every tag or banner change. That is the whole discipline, and in 2026 it is the difference between a letter and a fine.