GDPR Fines for Cookie Violations: What Happened in 2024

The Numbers

GDPR enforcement related to cookies and online tracking has accelerated dramatically. In 2024 alone, data protection authorities across Europe issued hundreds of decisions related to cookie consent, with fines ranging from €5,000 for small businesses to hundreds of millions for tech giants.

Cookie-related violations consistently rank among the top categories for GDPR enforcement actions.

Notable Cases

Case 1: Major E-Commerce Platform — €40M

What happened: The platform was found to set advertising cookies before users had given consent. Despite having a consent banner, the technical implementation didn't actually block marketing scripts until after consent was given.

Key lesson: Having a consent banner is not enough. The technical implementation must match. Regulators are increasingly using automated tools to verify that cookies are actually blocked pre-consent — not just that a banner is displayed.

Case 2: News Publisher Network — €8M

What happened: Multiple news websites in a single media group used pre-checked checkboxes for analytics and advertising cookies. The "reject" option required users to click through to a second page, toggle individual switches, and confirm — while "accept" was a single click.

Key lesson: The asymmetry between accepting and rejecting cookies is a clear dark pattern violation. The reject path must be as easy as the accept path.

Case 3: SaaS Company — €150K

What happened: A B2B SaaS company assumed that because their users were businesses, GDPR cookie rules didn't apply. They had no consent mechanism at all.

Key lesson: GDPR applies to all individuals in the EU, whether they're visiting a site in a personal or professional capacity. B2B sites need consent banners too.

Case 4: Small Business — €5K

What happened: A local service business used a WordPress theme with a built-in cookie banner that looked compliant but didn't actually block any cookies. The banner was purely decorative.

Key lesson: Don't trust your theme or plugin to be compliant out of the box. Verify that clicking "reject" actually blocks non-essential cookies. Use a tool like GDPR Fix to verify.

Trends in Enforcement

1. Automated Scanning by Regulators

Data protection authorities are increasingly using automated tools to scan websites at scale. The French CNIL, Austrian DSB, and Belgian DPA have all published reports on mass-scanning campaigns. If a regulator's automated tool finds violations, you'll receive a formal notice.

2. Cookie Walls Under Fire

Multiple authorities have ruled that cookie walls — blocking access to content unless cookies are accepted — do not constitute valid consent. The trend is clear: cookie walls will be considered non-compliant across the EU.

3. Complaint-Driven Enforcement

Privacy advocacy groups like noyb (led by Max Schrems) have filed thousands of cookie-related complaints across Europe. A single complaint about your website can trigger an investigation.

4. Focus on Dark Patterns

The EDPB's guidelines on dark patterns in social media (adopted in 2023) are being applied to cookie banners. Deceptive design practices — like making "accept" green and "reject" grey, or hiding reject behind "settings" — are being flagged.

How to Protect Yourself

1. Scan your site regularly — New plugins, updates, and third-party scripts can add cookies you didn't authorize
2. Verify your CMP works — Don't just install it and forget it. Test that rejecting cookies actually blocks them
3. Keep your cookie policy updated — It must reflect the actual cookies on your site
4. Document your compliance — If regulators investigate, you need to show you took reasonable steps
5. Use automated monitoring — Tools like GDPR Fix can alert you when your compliance score drops

The cost of compliance is a few hours of work and perhaps €5-10/month for monitoring tools. The cost of a fine starts at €5,000 and goes up from there. The math is straightforward.