Cookie Consent Fines Hit Record Levels in 2026. Is Your Website Next?
Cookie consent enforcement has entered a new phase in 2026. The numbers are no longer theoretical.
In France, the CNIL issued approximately 487 million euros in sanctions during 2025, with cookie violations and advertising trackers accounting for the majority. The largest single penalty was 150 million euros against fashion retailer SHEIN for placing advertising cookies without valid consent.
In the UK, the ICO reviewed the top 1,000 websites and found that 134 of the first 200 failed their compliance checks. That is 67 percent. The ICO sent letters, opened investigations, and issued 17 preliminary enforcement notices. By December 2025, over 95 percent of those sites had been brought into compliance, but only after direct regulatory intervention.
The UK fine ceiling just changed
The Data Use and Access Act 2025 raised the maximum PECR fine from the previous cap to the same level as UK GDPR fines: up to 17.5 million pounds or 4 percent of global annual turnover, whichever is higher. This came into effect in February 2026.
Previously, the maximum cookie fine in the UK was 500,000 pounds. That has increased by a factor of 35. The ICO now has the same enforcement power for cookie violations as it does for major data breaches.
What most businesses get wrong
The most common violation is straightforward: tracking cookies loading before the visitor has given consent. This includes Google Analytics cookies, Facebook pixels, and advertising trackers. If your analytics script runs the moment someone lands on your page, before they interact with any consent banner, you are in breach.
The second most common issue is the design of the consent banner itself. If your “Accept All” button is large and colourful while “Reject All” is small or hidden, regulators consider this a dark pattern. The ICO specifically looks for whether rejection is as easy as acceptance.
The third issue is consent banners that do not actually block anything. Having a banner that asks for permission but loads trackers regardless is arguably worse than having no banner at all, because it demonstrates awareness of the requirement combined with a decision not to comply.
How to check your own site
Open your website in an incognito browser window. Before clicking anything on the consent banner, open your browser developer tools (right-click, Inspect, Network tab) and look for requests to domains like google-analytics.com, googletagmanager.com, or facebook.net. If you see any of those before you have clicked Accept, your site has the same problem that led to the SHEIN fine.
You can also use free tools like CookieMetrix.com, which scans your site and reports what cookies are set before any user interaction.
If your site fails either of these checks, the fix is not complicated. A properly configured consent management tool like CookieYes or Complianz can block all non-essential scripts until consent is given. Most can be set up in under 30 minutes.
Want to check your website? LaunchKitty scans your site across 14 dimensions in 30 seconds. Free scan, no signup needed. Scan your website now.