Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by action- Other €1.19bn 66 % · 1 case
- Fine €589m 33 % · 16 cases
- Disgorgement of profits €15.4m 1 % · 1 case
- Reprimand or warning – 0 % · 2 cases
- Order – 0 % · 1 case
Who?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | €57.7m |
| 2023 | 3 | €50m |
| 2024 | 3 | €15.4m |
| 2025 | 10 | €1.67bn |
| 2026 | 3 | €2.31m |
21 cases
2 Jul 2026 SIA 4YOU MEBELESFurniture retailer 4YOU MEBELES ignores cookie inspection – first a reprimand, then 1,000 EUR €1,000
In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.
Assurances given to the supervisory authority are checked – false statements and silence aggravate the sanction.
Cookie banners and cooperation with the supervisory authority
- Authority / court
- Datu valsts inspekcija (DVI)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Culpability
- intentional
- Repeat case
- yes
- DVI Lēmums Par soda piemērošanu (SIA 4YOU MEBELES), 02.07.2026 Decision of an authority
- Datu valsts inspekcija – Lēmumi (Liste der veröffentlichten Entscheidungen) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Jun 2026 Monash IVF Pty LtdMonash IVF: tracking pixels on fertility website used without consent Order
Monash IVF collected sensitive information about visitors to its fertility treatment website through third-party tracking pixels. The Privacy Commissioner held that following the visitors of health-related websites and afterwards showing them targeted adverts on social networks amounts to collecting sensitive data, which requires consent, and found breaches of APP 3.3, 5.1, 5.2 and 7.1. Monash IVF must not continue or repeat the conduct and must implement specified remedial steps; a parallel determination against the telehealth provider Medmate Australia was made on the same day.
Anyone using tracking pixels on health websites needs visitors' consent and must know which data flows to advertising platforms.
Tracking pixels and advertising tools on websites with sensitive content
- Authority / court
- Office of the Australian Information Commissioner (OAIC)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Privacy Act 1988 (Cth), APP 3.3, 5.1, 5.2, 7.1
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Healthcare
- Published
- 24 Jun 2026
- OAIC: Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation (24.06.2026) Press release of an authority
- OAIC: Privacy determinations – Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 (11 June 2026) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
11 Feb 2026 Disney DTC, LLC und ABC Enterprises, Inc. (The Walt Disney Company)California: $2.75 million against Disney over incomplete opt-outs for streaming €2.31m
Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.
An opt-out must take effect across all services, devices and integrated third-party providers of an account.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 11 Feb 2026
Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 Nov 2025 American Express Carte FranceAmerican Express Carte France: 1.5 million EUR – marketing cookies despite ‘Reject all’ €1.5m
When the website was accessed, eight non-exempt cookies were placed without any user action; after ‘Reject all’, three marketing cookies were nevertheless placed when switching to an affiliated domain, and after consent was withdrawn, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 1.5 million EUR for this and, in view of the rectification during the proceedings, refrained from issuing an order; it found an infringement of data minimisation in the recording of customer calls but did not sanction it.
Cookie settings must apply across all domains of a service – including when users move to affiliated sites.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés (Geldbuße); Verstoß gegen Art. 5 Abs. 1 lit. c DSGVO (Gesprächsaufzeichnungen) festgestellt, aber nicht sanktioniert
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Mitigating circumstances
- Corrections during the proceedings, cooperation.
- CNIL, Délibération SAN-2025-011 du 27 novembre 2025 (Légifrance) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 Nov 2025 Les Publications Condé NastCNIL: 750,000 EUR against Vanity Fair publisher Condé Nast over cookies without consent €750,000
On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.
A cookie banner must technically deliver what it promises: after ‘Reject’, no further trackers may be set – and this should be tested regularly.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Repeat case
- yes
- Published
- 27 Nov 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
31 Oct 2025 Google LLCTexas: Google pays $1.375 billion over location, incognito and biometric data €1.19bn
Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.
Settings such as location history or incognito mode must deliver what they promise users – otherwise billion-dollar risks loom, even at the level of individual US states.
- Authority / court
- Office of the Attorney General of Texas
- Area of law
- Data protection · Cookies and tracking
- Action
- Other
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 31 Oct 2025
Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.
- Attorney General Ken Paxton Finalizes Historic Settlement with Google and Secures $1.375 Billion Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Google LLC und Google Ireland LimitedGoogle: 325 million EUR – advertising cookies at account creation and ads in the Gmail inbox €325m
When creating a Google account, users were not sufficiently informed that advertising cookies were necessarily placed in the process; in addition, Google displayed advertisements between e-mails in Gmail without prior consent. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 200 million EUR on Google LLC and 125 million EUR on Google Ireland and ordered remedial action within six months, subject to a penalty payment of 100,000 EUR per day.
Do not tacitly tie advertising cookies to account creation – and advertising in the inbox counts as direct marketing requiring consent.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés; Art. L. 34-5 Code des postes et des communications électroniques
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Infinite Styles Services Co. Limited (Shein)Shein: 150 million EUR – cookies without consent and despite rejection €150m
On shein.com, advertising cookies were placed without consent as soon as the site was accessed; in addition to an incomplete cookie banner, there was an advertising pop-up without an option to reject. After clicking ‘Reject all’ or withdrawing consent, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 150 million EUR.
A cookie banner must work technically: rejecting and withdrawing consent must actually stop cookies from being placed and read.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés (Umsetzung von Art. 5 Abs. 3 ePrivacy-Richtlinie)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 Aug 2025 DSB: fine against news portal that ignored instruction on cookie banner €6,200
In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.
Implement orders of the supervisory authority on time – ignoring them risks a separate fine in addition to the original infringement.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- DSB Straferkenntnis GZ 2025-0.276.820 vom 06.08.2025 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Jul 2025 Healthline Media LLCCalifornia: $1.55 million against Healthline over disclosure of illness-related article titles €1.31m
Despite objections, the health portal continued to pass data to advertising partners and transmitted article titles suggestive of diagnoses for targeted advertising; the consent banner did not stop the tracking. In addition, the required contractual clauses with advertising partners were missing. The settlement was reached with the Attorney General of California.
Test consent banners technically: if rejecting does not actually switch off tracking, that is misleading and unlawful.
- Authority / court
- Attorney General of California (California Department of Justice)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA), Unfair Competition Law
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Published
- 1 Jul 2025
Original amount 1,550,000 USD, converted at the ECB reference rate of 1 Jul 2025.
- Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 May 2025 AS Watson (Health & Beauty Continental Europe) B.V.AP reduces cookie fine against Kruidvat operator AS Watson to 50,000 EUR after objection €50,000
The company behind the Kruidvat drugstore chain tracked visitors to Kruidvat.nl with tracking cookies without their knowledge or consent, enabling it to build profiles from location, pages visited, shopping basket and purchases. The Dutch data protection authority (Autoriteit Persoonsgegevens, AP) had imposed 600,000 EUR in 2024, upheld the objection in May 2025 and reduced the fine to 50,000 EUR.
Set tracking cookies in an online shop only after genuine consent – pre-ticked or hidden consent is not sufficient.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 6 Abs. 1 i. V. m. Art. 5 Abs. 1 lit. a DSGVO (Tracking-Cookies ohne Einwilligung)
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Retail and e-commerce
- Published
- 12 Jun 2025
- Besluit op bezwaar AS Watson – Kruidvat (27 mei 2025) Decision of an authority
- Besluit boete AS Watson – Kruidvat Decision of an authority
- AP – Boete van 600.000 euro voor tracking cookies op Kruidvat.nl Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 May 2025 Yliopiston ApteekkiYliopiston Apteekki: 1.1 million EUR over tracking in online shop – court annuls fine overturned
In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).
Tracking tools on health-related websites can easily transmit sensitive data – include marketing technology in the data protection review.
Tracking pixels on sensitive websites
- Authority / court
- Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- DSGVO Art. 9, Art. 25, Art. 32
- Action
- Fine
- Status of proceedings
- overturned
- Sector
- Healthcare
- Published
- 4 Jun 2025
Amount in EUR; no ECB reference rate is available for this currency.
- Finlex – Tietosuojavaltuutettu 27.5.2025 (verkkoapteekin seurantateknologiat) Decision of an authority
- Tietosuojavaltuutettu – Hallinto-oikeudelta päätös Yliopiston Apteekille määrätystä seuraamusmaksusta (2.6.2026) Press release of an authority
- Helsingin hallinto-oikeus – kumosi Yliopiston Apteekille määrätyn 1,1 miljoonan euron seuraamusmaksun (01.06.2026) Court press release
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 May 2025 Todd Snyder, Inc.Todd Snyder: 345,178 USD – tracking opt-out ineffective for 40 days €304,793
For 40 days, the fashion retailer’s misconfigured privacy portal did not process objections to the sale and sharing of personal data; in addition, the company required too much data and identity verification before an opt-out. The California Privacy Protection Agency (CPPA) imposed 345,178 USD and required correct configuration of consent management and employee training.
A consent management platform does not relieve companies of responsibility: check regularly whether opt-outs are actually implemented technically.
Configuration and monitoring of consent management platforms
Missing or inadequate training played a role in the decision.
- Authority / court
- California Privacy Protection Agency (CPPA), Board
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Retail and e-commerce
Original amount 345,178 USD, converted at the ECB reference rate of 6 May 2025.
- CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine, Overhaul Privacy Practices (06.05.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Dec 2024 Aktiebolaget Trav och GaloppATG: reprimand over misleadingly designed cookie banner Reprimand or warning
Following a complaint – one of several complaints about cookie banners lodged with European data protection authorities – the Swedish Authority for Privacy Protection (IMY) found that the betting operator did not make withdrawing consent as easy as giving it and, through the misleading design of the banner (choice of colours, contrast, rejection only as a link), made informed, freely given consent more difficult. IMY issued a reprimand; ATG had since changed the banner.
Rejecting must be as easy as accepting: colour, contrast and link placement in the cookie banner must not steer the decision.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- DSGVO Art. 6, Art. 7 Abs. 3
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Other
- IMY – Tillsyn Aktiebolaget Trav och Galopp Decision of an authority
- IMY – Beslut efter tillsyn, IMY-2023-16453 (16.12.2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
2 Sep 2024 a UK online betting and gaming operatorICO: Reprimand for online gambling operator over advertising cookies without consent Reprimand or warning
The ICO issued a reprimand to a UK online betting and gaming operator (part of an international gambling group). The ICO found that between January and March 2023 the operator's website set third-party advertising cookies on arrival and thus processed visitors' personal data before they had consented. The ICO found processing without a lawful basis and without valid consent.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 5(1)(a), 6(1)(a) und 7(1) UK GDPR; Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Sep 2026 · Direct link
Report an error
26 Jun 2024 a British software maker and two subsidiariesSoftware maker: 16.5 million USD and ban on selling browsing data €15.4m
The FTC issued its final order against a British software maker, its Czech subsidiary and its former data subsidiary. According to the authority, the software maker collected detailed browsing data through browser extensions and antivirus software, stored it indefinitely and sold it via the data subsidiary to more than 100 third parties without adequate notice and consent, even though the products were marketed as protecting against online tracking. The software maker must pay 16,500,000 USD for consumer redress, may no longer sell or license browsing data for advertising purposes, must delete the data transferred to the data subsidiary together with any products and algorithms derived from it, and must set up a privacy programme.
A company that advertises protection against tracking must not monetise the same usage data itself – marketing claims and data use must match.
Privacy promises versus actual data use; sale of usage data
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)
- Action
- Disgorgement of profits
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 27 Jun 2024
Original amount 16,500,000 USD, converted at the ECB reference rate of 26 Jun 2024.
- Federal Trade Commission (FTC), Veröffentlichung der Behörde (Entscheidung 2024) Decision of an authority
Checked against the official source on 8 Oct 2026 · Company name anonymised since 26 Jun 2026 · Direct link
Report an error
29 Dec 2023 an Irish internet services providerCNIL: €10m fine for internet services provider over advertising cookies without consent €10m
The CNIL (French data protection authority) fined an Irish internet services provider EUR 10,000,000 under Art. 82 of the Loi Informatique et Libertés (French Data Protection Act) because at least 20 advertising cookies were placed without prior consent when its web portal was visited, and users who wanted to withdraw their cookie consent were deterred by being told they would lose access to its e-mail service. The case arose from 27 complaints lodged in 2019 and 2020; the Conseil d'État (French supreme administrative court) dismissed the company's appeal on 7 October 2025.
Withdrawing cookie consent must not be tied to losing another service such as the e-mail account.
Cookie consent and its withdrawal
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Culpability
- negligent
- Published
- 18 Jan 2024
- CNIL, Les sanctions prononcées par la CNIL (Übersicht) (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 29 Dec 2025 · Direct link
Report an error
15 Jun 2023 a French targeted online advertising providerCNIL: €40m fine for online advertising provider over missing proof of consent €40m
The CNIL (French data protection authority) fined a French targeted online advertising provider EUR 40,000,000 because, for its cookie-based retargeting, it could not prove that users had consented on partner websites, informed data subjects inadequately, did not fully implement the rights of access, withdrawal and erasure, and its joint controller arrangement with partners was incomplete (Art. 7, 12, 13, 15, 17 and 26 GDPR). The Conseil d'État (French supreme administrative court) dismissed the appeal on 4 March 2026.
Anyone collecting data through trackers on third-party websites must obtain verifiable assurances from partners that users have consented, and check them.
Proof of consent in online tracking
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 7, 12, 13, 15, 17 und 26 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 1,000 to 9,999
- Published
- 22 Jun 2023
- CNIL, Les sanctions prononcées par la CNIL (Übersicht) (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 15 Jun 2025 · Direct link
Report an error
7 Mar 2023 a Latvian electronics retailerLatvian electronics retailer – 20,000 EUR for cookie deficiencies upheld €20,000
In a preventive review, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) had pointed out deficiencies in the use of cookies on its website to the retailer and repeatedly set deadlines for remediation in 2022; the company asked for extensions but did not remedy the deficiencies and did not respond to the requests in substance. On 26 January 2023 the DVI imposed 20,000 EUR (Art. 83(5)(a), (b), (e) GDPR); the director dismissed the objection on 7 March 2023 and found intent.
Take cookie notices from the supervisory authority that come with a deadline seriously – subsequent rectification no longer prevents the fine.
Cookie consent in online retail
- Authority / court
- Datu valsts inspekcija (DVI)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 83 Abs. 5 lit. a, b und e DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Culpability
- intentional
- DVI, Entscheidungen (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Mar 2025 · Direct link
Report an error
29 Dec 2022 a technology companyCNIL: €8m fine for a technology company over advertising identifiers €8m
The CNIL (French data protection authority) fined a technology company EUR 8,000,000 under Art. 82 of the Loi Informatique et Libertés (French Data Protection Act) because identifiers were stored on and read from the company's smartphones to personalise advertising in its app marketplace without first obtaining users' consent. The Conseil d'État (French supreme administrative court) dismissed the appeal on 15 October 2025; the fact that the advertising segments are only created on the company's servers does not change the consent requirement for accessing the device.
Even the operating system provider needs consent before storing or reading identifiers on the device for advertising purposes.
Consent for advertising identifiers on devices
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 5 Jan 2023
- CNIL, Les sanctions prononcées par la CNIL (Übersicht) (Entscheidung 2022) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 29 Dec 2024 · Direct link