Cookie banner & dark pattern fines tracker
Short answer: We track enforcement over cookie consent and dark patterns that we could confirm on the regulator’s or court’s own page. 22 cases from 2024 to 2026 so far, adding up to €530.9M in European fines and $2.5B in US fines and settlements. 8 of them come from France’s CNIL.
Every case, newest first
| Date | Who | Outcome | What went wrong | Source |
|---|---|---|---|---|
16 Jul 2026 | Fitness studio operator (case brought by vzbv)Federal Court of Justice (BGH), I ZR 200/25 · Germany | —Court ruling | The cancellation confirmation page may not offer alternatives such as “pause instead”. | |
6 Jul 2026announcement date | 23 organisations (unnamed)CNIL (simplified procedure) · France | €133,750Finetotal, January–July 2026 | Included cookies set before consent and banners that accepted in one click but refused only through “Customise”.Trackers fire before consentNo “Reject” on the first layer | |
5 Mar 2026announcement date | Ford Motor Co.CalPrivacy (CPPA) · United States | $375,703Fine | Email verification demanded before people could opt out.“Reject” is harder to see than “Accept” | |
3 Mar 2026announcement date | PlayOn Sports (2080 Media)CalPrivacy (CPPA) · United States | $1,100,000Fine | People had to click “Agree” to tracking before they could use their tickets or view PlayOn’s websites; opt-out preference signals ignored.No “Reject” on the first layerTracking continues after “Reject” | |
11 Feb 2026announcement date | DisneyCalifornia Attorney General · United States | $2,750,000Settlement | Opt-outs, including Global Privacy Control, applied only to one device or service instead of the whole account.Tracking continues after “Reject” | |
30 Dec 2025announced 22 Jan 2026 | Unnamed company (not published by CNIL)CNIL · France | €3,500,000Fine | Eleven cookies set before any choice and still read after refusal; loyalty data sent to a social network for advertising.Trackers fire before consentTracking continues after “Reject” | |
27 Nov 2025announced 3 Dec 2025 | American Express Carte FranceCNIL · France | €1,500,000Fine | Cookies set before consent, after refusal and after consent was withdrawn.Trackers fire before consentTracking continues after “Reject”Tracking continues after consent is withdrawn | |
21 Nov 2025announcement date | Jam CityCalifornia Attorney General · United States | $1,400,000Settlement | No opt-out of data sales in 21 apps; teenagers’ data sold without opt-in. | |
20 Nov 2025announced 27 Nov 2025 | Les Publications Condé Nast (vanityfair.fr)CNIL · France | €750,000Fine | Cookies set before consent, some wrongly labelled “strictly necessary”, and “Refuse all” didn’t stop tracking.Trackers fire before consentTracking continues after “Reject” | |
30 Oct 2025announcement date | Sling TVCalifornia Attorney General · United States | $530,000Settlement | Cookie preferences mixed up with the legal opt-out, extra confirmation steps, and no opt-out inside the TV apps.“Reject” is harder to see than “Accept” | |
30 Sept 2025announcement date | Tractor Supply Co.CPPA · United States | $1,350,000Fine | No working opt-out, including through Global Privacy Control; incomplete notices and vendor contracts.Tracking continues after “Reject” | |
25 Sept 2025announcement date | AmazonFTC · United States | $2,500,000,000Settlement$1B civil penalty plus $1.5B in refunds | People signed up to Prime without clear consent, and cancelling was made hard (ROSCA). | |
1 Sept 2025announced 3 Sept 2025 | Google LLC & Google IrelandCNIL · France | €325,000,000Fine | Ads shown between Gmail emails without consent, and cookies set during Google account sign-up without valid consent.Trackers fire before consent | |
1 Sept 2025announced 3 Sept 2025 | SHEIN (Infinite Styles Services Co.)CNIL · France | €150,000,000Fine | Ad cookies set before any choice; clicking “Refuse all” didn’t stop new cookies being set or old ones being read.Trackers fire before consentTracking continues after “Reject” | |
1 Jul 2025announcement date | Healthline MediaCalifornia Attorney General · United States | $1,550,000Settlement | The consent banner didn’t switch off tracking cookies, and opt-outs, including Global Privacy Control, were ignored.Tracking continues after “Reject” | |
22 May 2025 | Otto (case brought by vzbv)Federal Court of Justice (BGH), I ZR 161/24 · Germany | —Court ruling | A cancellation button is required even for fixed-term memberships paid once. | |
6 May 2025announcement date | Todd Snyder, Inc.CPPA · United States | $345,178Fine | A misconfigured privacy portal didn’t process opt-outs for 40 days, and people had to prove their identity to opt out.Tracking continues after “Reject” | |
12 Mar 2025announcement date | American Honda Motor Co.CPPA · United States | $632,500Fine | An asymmetric privacy choice interface and excessive verification before opting out.“Reject” is harder to see than “Accept” | |
12 Dec 2024announcement date | Several website publishers (unnamed)CNIL · France | one month to complyCompliance order | Dark-pattern cookie banners: the reject option was de-emphasised or hidden, and accept was shown several times.“Reject” is harder to see than “Accept”No “Reject” on the first layer | |
14 Nov 2024announced 10 Dec 2024 | Orange SACNIL · France | €50,000,000Fineplus €100,000 for each day of delay if it doesn’t stop within 3 months | Ads disguised as emails without consent; cookies still read after consent was withdrawn.Tracking continues after “Reject”Tracking continues after consent is withdrawn | |
26 Sept 2024 | Aldi Süd (case brought by VZ Baden-Württemberg)EU Court of Justice, C-330/23 · EU | —Court ruling | A percentage discount must be calculated from the lowest price of the previous 30 days. | |
21 Feb 2024announcement date | DoorDashCalifornia Attorney General · United States | $375,000Settlement | Customer data sold through a marketing co-op without notice or a way to opt out. |
Download CSVFree to reuse under CC BY 4.0 with a link to this page.
What the cases have in common
Most European cookie fines come down to three things that a browser can show in minutes: tags that fire before the visitor chooses, a “Refuse all” that doesn’t stop them, and a refusal that takes more effort than accepting. In California, the pattern is the same one step later: opt-outs, including Global Privacy Control signals, that were ignored or made harder than they needed to be.
None of this needs an inspector inside your company. Regulators, consumer groups and competitors test from the outside, with a browser, like a first-time visitor.
How we build this list
- Each case is checked on the regulator’s or court’s own page (for EU court rulings, the official text on EUR-Lex), and linked.
- We show the decision date, and the announcement date when it’s later. Some rows only have the day a case was announced, such as court settlements and California’s privacy orders (the orders themselves are dated earlier). The table marks those “announcement date”, and the CSV’s
date_typecolumn saysannouncement. - Cases we couldn’t confirm at the source are left out until we can.
- Some regulators, CNIL included, don’t always publish company names, or remove them after a while. We list those cases as unnamed.
Questions people ask
What is the biggest cookie consent fine so far?
Among the cases in this tracker, the largest is the €325 million CNIL fine against Google (September 2025), for ads between Gmail emails without consent and cookies set at account sign-up without valid consent. SHEIN’s €150 million fine, announced the same day, is the largest one about a shop’s cookie banner.
Who enforces cookie banners in Europe?
Each country’s data protection authority. France’s CNIL is by far the most active on cookies: besides large fines, it issues compliance orders and smaller fines through a simplified procedure.
What goes wrong most often?
The same three things again and again: trackers that load before a choice, a refusal that doesn’t stop tracking, and a reject option that is harder to use than accept. All three are what an automated browser test catches.
Can I reuse this data?
Yes. The table and CSV are free to reuse under CC BY 4.0: credit “untick (untick.io)” with a link to this page.
Check your own site
The patterns behind most of these cases are what untick tests from the outside: trackers before consent, a reject button that doesn’t work, and unequal choices.