Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by countryWhat for?
by action- Fine €477.3m 100 % · 8 cases
- Reprimand or warning — 0 % · 1 case
Who?
by sectorAll sectors
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 0 | — |
| Q4 2024 | 1 | — |
| Q1 2025 | 0 | — |
| Q2 2025 | 2 | €50,000 |
| Q3 2025 | 3 | €475m |
| Q4 2025 | 2 | €2.25m |
| Q1 2026 | 0 | — |
| Q2 2026 | 0 | — |
| Q3 2026 | 1 | €1,000 |
9 cases
2 Jul 2026 SIA 4YOU MEBELESFurniture retailer 4YOU MEBELES ignores cookie inspection – first a reprimand, then 1,000 EUR €1,000
In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.
Assurances given to the supervisory authority are checked – false statements and silence aggravate the sanction.
Cookie banners and cooperation with the supervisory authority
- Authority / court
- Datu valsts inspekcija (DVI)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Culpability
- intentional
- Repeat case
- yes
- DVI Lēmums Par soda piemērošanu (SIA 4YOU MEBELES), 02.07.2026 Decision of an authority
- Datu valsts inspekcija – Lēmumi (Liste der veröffentlichten Entscheidungen) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 Nov 2025 American Express Carte FranceAmerican Express Carte France: 1.5 million EUR – marketing cookies despite ‘Reject all’ €1.5m
When the website was accessed, eight non-exempt cookies were placed without any user action; after ‘Reject all’, three marketing cookies were nevertheless placed when switching to an affiliated domain, and after consent was withdrawn, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 1.5 million EUR for this and, in view of the rectification during the proceedings, refrained from issuing an order; it found an infringement of data minimisation in the recording of customer calls but did not sanction it.
Cookie settings must apply across all domains of a service – including when users move to affiliated sites.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés (Geldbuße); Verstoß gegen Art. 5 Abs. 1 lit. c DSGVO (Gesprächsaufzeichnungen) festgestellt, aber nicht sanktioniert
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Mitigating circumstances
- Corrections during the proceedings, cooperation.
- CNIL, Délibération SAN-2025-011 du 27 novembre 2025 (Légifrance) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 Nov 2025 Les Publications Condé NastCNIL: 750,000 EUR against Vanity Fair publisher Condé Nast over cookies without consent €750,000
On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.
A cookie banner must technically deliver what it promises: after ‘Reject’, no further trackers may be set – and this should be tested regularly.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Repeat case
- yes
- Published
- 27 Nov 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Google LLC und Google Ireland LimitedGoogle: 325 million EUR – advertising cookies at account creation and ads in the Gmail inbox €325m
When creating a Google account, users were not sufficiently informed that advertising cookies were necessarily placed in the process; in addition, Google displayed advertisements between e-mails in Gmail without prior consent. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 200 million EUR on Google LLC and 125 million EUR on Google Ireland and ordered remedial action within six months, subject to a penalty payment of 100,000 EUR per day.
Do not tacitly tie advertising cookies to account creation – and advertising in the inbox counts as direct marketing requiring consent.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés; Art. L. 34-5 Code des postes et des communications électroniques
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Infinite Styles Services Co. Limited (Shein)Shein: 150 million EUR – cookies without consent and despite rejection €150m
On shein.com, advertising cookies were placed without consent as soon as the site was accessed; in addition to an incomplete cookie banner, there was an advertising pop-up without an option to reject. After clicking ‘Reject all’ or withdrawing consent, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 150 million EUR.
A cookie banner must work technically: rejecting and withdrawing consent must actually stop cookies from being placed and read.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés (Umsetzung von Art. 5 Abs. 3 ePrivacy-Richtlinie)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 Aug 2025 DSB: fine against news portal that ignored instruction on cookie banner €6,200
In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.
Implement orders of the supervisory authority on time – ignoring them risks a separate fine in addition to the original infringement.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- DSB Straferkenntnis GZ 2025-0.276.820 vom 06.08.2025 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 May 2025 AS Watson (Health & Beauty Continental Europe) B.V.AP reduces cookie fine against Kruidvat operator AS Watson to 50,000 EUR after objection €50,000
The company behind the Kruidvat drugstore chain tracked visitors to Kruidvat.nl with tracking cookies without their knowledge or consent, enabling it to build profiles from location, pages visited, shopping basket and purchases. The Dutch data protection authority (Autoriteit Persoonsgegevens, AP) had imposed 600,000 EUR in 2024, upheld the objection in May 2025 and reduced the fine to 50,000 EUR.
Set tracking cookies in an online shop only after genuine consent – pre-ticked or hidden consent is not sufficient.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 6 Abs. 1 i. V. m. Art. 5 Abs. 1 lit. a DSGVO (Tracking-Cookies ohne Einwilligung)
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Retail and e-commerce
- Published
- 12 Jun 2025
- Besluit op bezwaar AS Watson – Kruidvat (27 mei 2025) Decision of an authority
- Besluit boete AS Watson – Kruidvat Decision of an authority
- AP – Boete van 600.000 euro voor tracking cookies op Kruidvat.nl Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 May 2025 Yliopiston ApteekkiYliopiston Apteekki: 1.1 million EUR over tracking in online shop – court annuls fine overturned
In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).
Tracking tools on health-related websites can easily transmit sensitive data – include marketing technology in the data protection review.
Tracking pixels on sensitive websites
- Authority / court
- Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- DSGVO Art. 9, Art. 25, Art. 32
- Action
- Fine
- Status of proceedings
- overturned
- Sector
- Healthcare
- Published
- 4 Jun 2025
Amount in EUR; no ECB reference rate is available for this currency.
- Finlex – Tietosuojavaltuutettu 27.5.2025 (verkkoapteekin seurantateknologiat) Decision of an authority
- Tietosuojavaltuutettu – Hallinto-oikeudelta päätös Yliopiston Apteekille määrätystä seuraamusmaksusta (2.6.2026) Press release of an authority
- Helsingin hallinto-oikeus – kumosi Yliopiston Apteekille määrätyn 1,1 miljoonan euron seuraamusmaksun (01.06.2026) Court press release
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Dec 2024 Aktiebolaget Trav och GaloppATG: reprimand over misleadingly designed cookie banner Reprimand or warning
Following a complaint – one of several complaints about cookie banners lodged with European data protection authorities – the Swedish Authority for Privacy Protection (IMY) found that the betting operator did not make withdrawing consent as easy as giving it and, through the misleading design of the banner (choice of colours, contrast, rejection only as a link), made informed, freely given consent more difficult. IMY issued a reprimand; ATG had since changed the banner.
Rejecting must be as easy as accepting: colour, contrast and link placement in the cookie banner must not steer the decision.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- DSGVO Art. 6, Art. 7 Abs. 3
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Other
- IMY – Tillsyn Aktiebolaget Trav och Galopp Decision of an authority
- IMY – Beslut efter tillsyn, IMY-2023-16453 (16.12.2024) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link