What are the fines for non-compliant cookie banners in the EU?

There is no single fixed EU-wide fine for a non-compliant cookie consent banner. Penalties depend on the Member State, the nature of the violation, and whether the issue also involves a breach of the GDPR.

• National cookie law penalties: EU Member States set their own penalties for violations of cookie rules under their national implementation of the ePrivacy Directive.

• GDPR fines: If a non-compliant banner results in invalid consent or unlawful processing of personal data, GDPR fines can reach €20 million or 4% of the company’s total worldwide annual turnover from the preceding financial year, whichever is higher.

• Corrective measures: Authorities may also order a website to change its cookie consent practices, stop certain processing activities, or bring its consent mechanism into compliance.

• Case-specific penalties: The final amount depends on factors such as the severity and duration of the infringement, the number of people affected, previous violations, and whether the infringement was intentional or negligent.

A non-compliant cookie banner does not automatically result in the maximum GDPR fine. The applicable penalty depends on the specific legal violation and the rules of the EU Member State involved.