Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe and North America: 756 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

Data protection Cookies and tracking Financial services and insurance Clear all filters

1case from 1 jurisdiction

€1.5mTotal of monetary amounts

€1.5mLargest single case: American Express Carte France

€1.5mMedian per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by region

All jurisdictions

EU €1.5m 100 % · 1 case

What for?

by action

Fine €1.5m 100 % · 1 case

Who?

by company

American Express Carte France €1.5m 100 % · 1 case

When?

per quarter, by date of decision

Trend
Period	Cases	Total
Q3 2023	0	—
Q4 2023	0	—
Q1 2024	0	—
Q2 2024	0	—
Q3 2024	0	—
Q4 2024	0	—
Q1 2025	0	—
Q2 2025	0	—
Q3 2025	0	—
Q4 2025	1	€1.5m
Q1 2026	0	—
Q2 2026	0	—
Q3 2026	0	—

1 case

Newest first Highest amounts

27 Nov 2025 American Express Carte FranceAmerican Express Carte France: 1.5 million EUR – marketing cookies despite ‘Reject all’ FranceCookies and tracking €1.5m

When the website was accessed, eight non-exempt cookies were placed without any user action; after ‘Reject all’, three marketing cookies were nevertheless placed when switching to an affiliated domain, and after consent was withdrawn, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 1.5 million EUR for this and, in view of the rectification during the proceedings, refrained from issuing an order; it found an infringement of data minimisation in the recording of customer calls but did not sanction it.

What organisations can take from it

Cookie settings must apply across all domains of a service – including when users move to affiliated sites.

Authority / court: Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
Area of law: Data protection · Cookies and tracking
Legal basis: Art. 82 Loi Informatique et Libertés (Geldbuße); Verstoß gegen Art. 5 Abs. 1 lit. c DSGVO (Gesprächsaufzeichnungen) festgestellt, aber nicht sanktioniert
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Employees: 10,000 or more
Mitigating circumstances: Corrections during the proceedings, cooperation.

Sources

CNIL, Délibération SAN-2025-011 du 27 novembre 2025 (Légifrance) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Who was sanctioned, and for what?

Ready for training that sticks?