Explainer No. 1 · Websites and marketing · Updated 6 Oct 2026 · 3 min read

Our cookie banner has no “reject” button. How big are the fines?

Potentially very big. European regulators expect refusing cookies to be as easy as accepting them. In December 2021 the French regulator, the CNIL, fined Google €150 million and Facebook €60 million because accepting took one click and refusing took several. Smaller cases end in fines of tens of thousands of euros, or in a reprimand (a formal warning without a fine).

The rule

Cookies are mainly governed by the ePrivacy Directive, not the GDPR. Its Article 5(3) says that storing or reading information on a visitor’s device

“is only allowed on condition that the subscriber or user concerned has given his or her consent”

The only exception is what is strictly necessary for a service the visitor asked for, such as remembering the items in a shopping basket. Analytics and advertising cookies need consent.

The Directive works through each country’s own law, which is why the decisions cite national laws: in France, Article 82 of the Loi Informatique et Libertés; in Spain, Article 22(2) of the LSSI. Read the Directive on EUR-Lex ↗

What counts as consent

For the meaning of consent, the Directive uses the GDPR. Article 4(11) says consent must be “freely given, specific, informed and unambiguous”. Three more lines decide most banner cases:

• Article 7(3): “It shall be as easy to withdraw as to give consent.”
• Recital 42: consent is not free if the person is “unable to refuse or withdraw consent without detriment”.
• Recital 32: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”

Regulators read these together. If saying no takes more effort than saying yes, the consent is not valid, and every non-essential cookie placed on the strength of it is unlawful.

Why the biggest fines come from France

Under the GDPR, a complaint about a company whose EU base is in Ireland normally goes to the Irish regulator. This is called the “one-stop shop”. Cookie rules come from the ePrivacy Directive, where the one-stop shop does not apply. So the CNIL could fine Google and Facebook directly for the cookies they placed on French visitors’ devices, and most of the large cookie fines in Fino come from France.

What regulators decided

The closest decisions in Fino, biggest fine first. Each line opens the decision with its source.

• Dec 2021Google LLCAccepting took one click, refusing took several, on google.fr and YouTube.CNIL (France) · France€150,000,000
• Dec 2021Facebook Ireland LimitedThe same finding for facebook.com.CNIL (France) · France€60,000,000
• Oct 2020IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA UNIPERSONALNo way to reject all cookies at once; cookies placed before visitors chose.AEPD (Spain) · Spain€30,000
• Oct 2019Vueling Airlines S.A.Pre-ticked boxes, and cookies still placed after “reject all”.AEPD (Spain) · Spain€18,000
• Oct 2024RTL Belgium SANo “reject” on the first screen; “accept all” in an eye-catching colour.APD/GBA (Belgium) · BelgiumReprimand
• Dec 2024Aktiebolaget Trav och Galopp“Accept” stood out and refusing took extra steps.IMY (Sweden) · SwedenReprimand

Decided the other way

• Feb 2023Maggioli S.p.A.An “X” instead of “reject” was accepted, because the banner explained what the X does.Garante per la protezione dei dati personali (Italy) · ItalyNo fine
• Feb 2024Not named in the sourceNo “reject all” on the first screen, but nothing was ticked in advance, so “confirm my choices” placed no cookies.APD/GBA (Belgium) · BelgiumNo fine

See every decision in Fino and search for “cookie”.

Check your own banner

1. Is “Reject all” on the first screen, next to “Accept all”?
2. Do both buttons stand out equally: same size, similar colours, same number of clicks?
3. Are any non-essential cookies placed before the visitor chooses? Open the site in a private window and look.
4. Does “Reject” really stop them? Test it after clicking.
5. Can visitors change their mind later just as easily, for example through a link in the footer?