Cookie rules are old. What changed in the past year is the scale of the penalties and the number of regulators applying them.
France sets the level
In September 2025 the French regulator, the CNIL, fined Google €325 million and Shein €150 million for setting advertising trackers without valid consent and making refusal harder than acceptance. A further fine, on American Express, followed in January 2026. The CNIL has kept cookies on its list of enforcement priorities for 2026.
The UK raises its ceiling
Since 5 February 2026 the maximum penalty under the UK’s cookie rules (PECR) has been £17.5 million or 4% of worldwide turnover, the same as under the UK GDPR. The old maximum was £500,000. The ICO’s final guidance, published in April 2026, covers pixels, fingerprinting, link decoration and scripts as well as cookies. The new exemptions for statistics and site appearance are narrow, and they still require transparency and an opt-out. The ICO has been testing the UK’s 1,000 most-visited websites and says it will keep doing so.
California gets there another way
California has no cookie-consent law. It has a right to opt out of the sale or sharing of personal data, and regulators treat advertising trackers as sharing. The 2026 actions against Disney, a ticketing platform and Ford all turned on opt-outs that failed in practice, including ignoring the Global Privacy Control signal and forcing users to accept tracking.
What is not law yet
The EU’s Digital Omnibus would change the cookie rules, including a requirement to respect browser signals. It has not been adopted.
What to do
Make refusing as easy as accepting. Check what your tags actually fire before consent, not what the banner says. Honour browser opt-out signals for US visitors. Repeat the check every quarter, because marketing tools change without anyone telling legal.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.