Every CNIL cookie fine since 2020: 53 sanctions, up to €967.7 million
We read the French regulator's sanctions list and the published decisions one by one. 15 fines of a million euros or more, 27 small ones nobody writes about, what each was for, and what happened on appeal.
The muro team
muro.chat
- Published
- Reading time
- 12 min
On this page
- The total is a range, not a number
- Year by year
- The 15 fines of a million euros or more
- The full list of fines of €100,000 and above
- What the CNIL actually punishes
- The publisher answers for the tools it embeds
- The 27 fines nobody writes about
- On appeal: every ruling we found upheld the fine
- Outside France, cookie-rule fines are small
- Before the fines: formal notices
- Method and limits
- Sources
France enforces its cookie rules with fines, and it publishes them. Since 2020 the CNIL has issued 53 sanctions in which cookies or other trackers are a ground, from €2,000 against a travel agency to €325 million against Google. The numbers that circulate are usually the three or four biggest. We went through the regulator's own list, opened every published decision of €100,000 or more, and checked what happened on appeal.
53
CNIL sanctions with a tracker ground, 2020 to 14 April 2026
€967.7 million
in fines, counting each fine in full (at least €585.1 million for trackers alone)
21
sanctions in 2025 alone, the busiest year so far
€5,000
median of the 27 fines issued under the simplified procedure
The total is a range, not a number
Adding up the 53 fines gives €967.7 million. That figure is a ceiling. Of those fines, 16 also punish something else, such as advertising inserted between emails, data retention or security, and 11 of those give a single amount with no split between the grounds. The two largest of that kind are the €325 million Google decision of 1 September 2025 and the €50 million Orange decision of 14 November 2024.
The floor is €585.1 million: the 37 fines that rest on the tracker rule alone (€584 million), plus the tracker share of the mixed fines whose decision states one. The real amount paid for cookies lies between the two and cannot be computed from what is published.
Year by year
CNIL fines with a cookie or tracker ground, by year
Full amount of each fine, including fines that also punish other breaches. 2026: the CNIL list we read stops on 14 April 2026.
View as table
| CNIL fines with a cookie or tracker ground, by year | Note | |
|---|---|---|
| 2020 | €138M | 4 sanctions. Largest: Google, €100 million. |
| 2021 | €211M | 4 sanctions. Largest: Google, €150 million. |
| 2022 | €76M | 4 sanctions. Largest: Microsoft, €60 million. |
| 2023 | €11M | 6 sanctions. Largest: Yahoo, €10 million. |
| 2024 | €50M | 13 sanctions. Largest: Orange, €50 million. |
| 2025 | €482M | 21 sanctions. Largest: Google, €325 million. |
| 2026 | €15K | 1 sanction. Largest: Event ticketing, €15,000. |
Source: CNIL sanctions list and published deliberations (Legifrance). Compiled by muro.
The amounts follow the big cases: 2025 is the record year with €482.2 million, almost all of it from two decisions issued on the same day against Google and Shein. The count tells a different story.
Number of CNIL sanctions with a cookie or tracker ground, by year
All procedures. The simplified procedure, capped at €20,000 per fine, started producing cookie sanctions in 2023.
View as table
| Number of CNIL sanctions with a cookie or tracker ground, by year | Note | |
|---|---|---|
| 2020 | 4 | None under the simplified procedure. |
| 2021 | 4 | None under the simplified procedure. |
| 2022 | 4 | None under the simplified procedure. |
| 2023 | 6 | 1 under the simplified procedure. |
| 2024 | 13 | 12 under the simplified procedure. |
| 2025 | 21 | 13 under the simplified procedure. |
| 2026 | 1 | 1 under the simplified procedure. |
Source: CNIL sanctions list. Compiled by muro.
From four sanctions a year between 2020 and 2022 to 13 in 2024 and 21 in 2025. The CNIL's own review of 2025 gives the same figure of 21 organisations sanctioned over trackers that year. The growth comes from the simplified procedure, created in 2022 for straightforward cases: a single member of the sanctions committee decides, the fine is capped at €20,000 and the decision is not made public. In 2025, 13 of the 21 cookie sanctions went through it.
The 15 fines of a million euros or more
CNIL fines of €1 million or more with a cookie or tracker ground
Full amount of each fine. Hover or focus a bar for the scope of the decision.
View as table
| CNIL fines of €1 million or more with a cookie or tracker ground | Note | |
|---|---|---|
| Google, 2025 | €325M | Google account creation and Gmail. Several grounds, no split published. |
| Google, 2021 | €150M | google.fr and youtube.com. Tracker rule only. |
| Shein, 2025 | €150M | shein.com. Tracker rule only. |
| Google, 2020 | €100M | google.fr. Tracker rule only. |
| Facebook, 2021 | €60M | facebook.com. Tracker rule only. |
| Microsoft, 2022 | €60M | bing.com. Tracker rule only. |
| Orange, 2024 | €50M | orange.fr and Mail Orange. Several grounds, no split published. |
| Amazon, 2020 | €35M | amazon.fr. Tracker rule only. |
| Yahoo, 2023 | €10M | yahoo.com and Yahoo Mail. Tracker rule only. |
| Apple, 2022 | €8.0M | App Store on iOS 14.6. Tracker rule only. |
| TikTok, 2022 | €5.0M | tiktok.com. Tracker rule only. |
| Service company (loyalty programme), 2025 | €3.5M | Of which €1 million for trackers. |
| Voodoo, 2022 | €3.0M | mobile games on iOS. Tracker rule only. |
| Carrefour France, 2020 | €2.3M | carrefour.fr. Several grounds, no split published. |
| American Express, 2025 | €1.5M | French website. Tracker rule only. |
Source: Published CNIL deliberations (Legifrance). Compiled by muro.
Google appears three times, for €575 million in total. Each of these decisions concerns the company's own site, app or operating system.
The full list of fines of €100,000 and above
Three decisions are not published: all that is public is one line in the CNIL list. Three companies are described and not named here, see the method section. Legifrance now shows "société X" in most decisions older than two years.
What the CNIL actually punishes
The rule behind all of these decisions is one article of French law, which transposes Article 5(3) of the ePrivacy Directive:
“Any subscriber or user of an electronic communications service must be informed in a clear and complete manner, unless they have been informed beforehand, by the controller or its representative, of: 1° The purpose of any action intended to access, by electronic transmission, information already stored in their electronic communications terminal equipment, or to write information to that equipment; 2° The means available to them to object to it. Such access or writing may take place only on condition that the subscriber or user has expressed, after receiving this information, their consent, which may result from appropriate settings of their connection device or of any other device under their control. These provisions do not apply if the access to information stored in the user's terminal equipment, or the writing of information to the user's terminal equipment: 1° Either has the sole purpose of enabling or facilitating communication by electronic means; 2° Or is strictly necessary for the provision of an online communication service at the user's express request.”
For the 22 decisions of €100,000 or more whose text is published, we tagged each breach the decision describes. One decision can carry several.
Tracker breaches found in the 22 published decisions of €100,000 or more
Number of decisions in which each type of breach appears. A decision can appear in several rows.
View as table
| Tracker breaches found in the 22 published decisions of €100,000 or more | |
|---|---|
| Trackers placed or read before any consent | 17 |
| Trackers still placed or read after a refusal or a withdrawal | 8 |
| Missing or incomplete information | 7 |
| Refusing harder than accepting | 5 |
Source: Published CNIL deliberations (Legifrance), tagged by muro from the grounds of each decision.
The first row is the one to remember. In 17 of 22 decisions, the site or app wrote or read something on the device before the visitor had made any choice. It is also the simplest to establish: the online checks described in the decisions consist of loading the page and listing what was stored before any click. The decisions count them, for instance 39 cookies on arrival on Carrefour's home page and 31 on Carrefour Banque's.
The second is the mirror image: the visitor says no, or changes their mind, and trackers are placed or read anyway (8 decisions, including 4 of the 5 published in 2025). The cases where refusing took more effort than accepting are fewer, 5 decisions, but they carry €600 million of the total.
Eight of these decisions came with an order to fix the tracker breach under a daily penalty, up to €100,000 per day of delay.
The publisher answers for the tools it embeds
Three of the decisions name a third-party tool as the source of the breach: Google reCAPTCHA at Cityscoot, Google Analytics at an online clairvoyance service and Google Analytics with reCAPTCHA at an online payment service. In each case the fine went to the company that installed the tool on its site, not to the company that makes it. The €50,000 fine of 27 July 2021 against Le Figaro follows the same logic for advertising cookies placed by partners.
That is the part that concerns anything loaded from a third party, an analytics tag, a captcha, an embedded video or a chat widget: what it stores on arrival is counted against the site that embeds it. We looked at where chat widgets stand under the same rule in Does a chat widget need cookie consent?, and measured what 25 of them do on arrival in our chat widget privacy benchmark.
The 27 fines nobody writes about
Below the headlines there is a second population: 27 fines issued under the simplified procedure since 2023, between €2,000 and €20,000, for €224,000 in total. The CNIL does not name these organisations, only their line of business, and those are ordinary. The ones that come up more than once are clothing retail (4), distance selling (3), press agency (2) and newspaper publisher (2). The rest range from a travel agency to a local authority.
All under the simplified procedure and unnamed, except the first row (ordinary procedure, public decision). Where two rows share a date and a line of business, the CNIL list has one line per organisation.
Eight of them are dated the same day, 12 December 2024, and 11 of the 27 came with an order to comply. For a small site the realistic exposure is not a seven-figure fine. It is a few thousand euros and an order to fix the banner.
On appeal: every ruling we found upheld the fine
Fines can be challenged before the Conseil d'État, France's highest administrative court. We found a ruling for 5 of the fines in the table, and the court rejected the company's appeal each time: Google (28 January 2022), Amazon (27 June 2022), Apple (15 October 2025), Voodoo (14 May 2024) and Yahoo (7 October 2025). It also upheld the Criteo fine. One appeal is pending, Orange's, after a constitutional question on the email advertising ground. For the other decisions we found no ruling, which does not prove that no appeal was lodged.
Outside France, cookie-rule fines are small
We looked for the largest decisions by other EU and EEA authorities. They fall in two groups that are often mixed up. Fines that apply cookie consent rules to a website, the true equivalent of the French ones, are small: the largest we found is €600,000 against Kruidvat in the Netherlands, later reduced to €50,000. In Spain the cookie rule is a minor infringement capped at €30,000.
The largest we could verify, not a guaranteed ranking: several authorities do not publish cookie fines. Kruidvat and Coolblue rely on secondary sources because the authority's pages could not be read.
The large numbers quoted for other countries are GDPR decisions about the legal basis for behavioural advertising. They are about tracking, but they are not cookie-law fines, and their status matters:
Two of the decisions in these two tables have been annulled, including the largest. Amounts marked "converted" were set in another currency.
Before the fines: formal notices
Most cases never reach a fine. In 2021 the CNIL ran three waves of formal notices on cookie banners, each giving the organisation a deadline to comply. Its annual report for that year counts 89 formal notices with a tracker breach, and its 2023 assessment of the campaign counts 94 after 125 online checks; the regulator does not explain the difference. No cookie-specific count has been published for the following years.
Method and limits
- Source. The CNIL page listing its sanctions, read year by year in French and English, version dated 14 April 2026. Nothing after that date is in the list. Each decision of €100,000 or more that has a Legifrance link was opened and its operative part read.
- What counts. A sanction is in the list when a breach of Article 82 of the French Data Protection Act is one of its grounds. Two decisions that the CNIL list does not label "cookies" were found by reading the texts. Fines based only on the email advertising rule are out.
- Names. The CNIL withdraws its press releases after two years and Legifrance replaces the name with "société X". We name a company when an official document still does: a CNIL annual report or a Conseil d'État ruling. For three decisions of 2023 the link between the name and the amount rests on secondary evidence, so we describe the business instead.
- Unpublished decisions. Three fines of €100,000 or more and all the simplified-procedure fines are known only from one line in the list: date, line of business, amount, label.
- Tags. The breach types are our reading of the grounds of each decision. The downloadable file has the decision number and link for each row so the reading can be checked.
- Appeals. "No appeal decision found" means we searched the Conseil d'État and Legifrance and found nothing, not that the fine is final.
- Possible gaps. Unpublished decisions on other subjects may contain a tracker ground we cannot see. A CNIL release of July 2026 mentions cookies among the subjects of 23 simplified-procedure sanctions issued since January; one of them is in this list.
For transparency about our own product: muro is a chat widget, so it is on the receiving end of this rule. By default it writes its keys to localStorage when it initialises. Since October 2026 it has a lazy mode in which nothing is read, written or sent until the visitor opens the chat.
Sources
- 1CNIL, Les sanctions prononcées par la CNIL (list by year) (accessed 2026-10-10)
- 2Loi Informatique et Libertés, Article 82 (Legifrance) (accessed 2026-10-10)
- 3CNIL, Bilan des sanctions 2025 (accessed 2026-10-10)
- 4CNIL, assessment of the cookie action plan (16 May 2023) (accessed 2026-10-10)
- 5CNIL, annual report 2020 (sanctions table) (accessed 2026-10-10)
- 6CNIL, annual report 2021 (accessed 2026-10-10)
- 7CNIL, annual report 2022 (accessed 2026-10-10)
- 8CNIL, annual report 2023 (accessed 2026-10-10)
- 9Conseil d'État, 28 January 2022, no. 449209 (Google) (accessed 2026-10-10)
- 10Conseil d'État, 27 June 2022, no. 451423 (Amazon) (accessed 2026-10-10)
- 11Conseil d'État, 15 October 2025, no. 473833 (Apple) (accessed 2026-10-10)
- 12Conseil d'État, 14 May 2024, no. 472221 (Voodoo) (accessed 2026-10-10)
- 13Conseil d'État, 7 October 2025, no. 494300 (Yahoo) (accessed 2026-10-10)
- 14Commission nationale pour la protection des données (CNPD): Amazon, 15 July 2021 (accessed 2026-10-10)
- 15Data Protection Commission (DPC): LinkedIn, 22 October 2024 (accessed 2026-10-10)
- 16Data Protection Commission (DPC): Facebook, 31 December 2022 (accessed 2026-10-10)
- 17Data Protection Commission (DPC): Instagram, 31 December 2022 (accessed 2026-10-10)
- 18Datatilsynet: Grindr, 13 December 2021 (accessed 2026-10-10)
- 19Integritetsskyddsmyndigheten (IMY): Bonnier News, 26 June 2023 (accessed 2026-10-10)
- 20Autoriteit Persoonsgegevens (AP): Kruidvat, May 2024 (accessed 2026-10-10)
- 21Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA): IAB Europe (consent framework), 2 February 2022 (accessed 2026-10-10)
- 22Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA): Roularta (knack.be, levif.be), 25 May 2022 (accessed 2026-10-10)
- 23Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA): Rossel (lesoir.be, sudinfo.be), 16 June 2022 (accessed 2026-10-10)
- 24Autoriteit Persoonsgegevens (AP): Coolblue, 23 December 2024 (accessed 2026-10-10)
- 25Úřad pro ochranu osobních údajů (ÚOOÚ): Unnamed company, 2023 (accessed 2026-10-10)
- 26Agencia Española de Protección de Datos (AEPD): Vueling, 1 October 2019 (accessed 2026-10-10)
