In September 2025, France's data protection authority CNIL issued a single-day record: a €325 million fine against Google and a €150 million fine against Shein — both for cookie consent violations. Google's specific offence? Making it harder to reject cookies than to accept them.

That asymmetry is one of the most common mistakes on European websites. And it's sitting on millions of SMB sites right now, invisible to the owners, perfectly visible to regulators.

Cookie banners are not a checkbox exercise. They are a legal mechanism for obtaining valid consent under GDPR and the ePrivacy Directive — and most of the ones we audit fail at least two or three of the requirements. This article walks through the five most frequent violations we see, what the law actually requires, and how to fix each one.

Before we get to the mistakes, it helps to understand what's actually required.

Cookie consent in the EU is governed by two pieces of legislation working together:

The ePrivacy Directive (2002/58/EC) — also called the "Cookie Law" — requires that no non-essential cookie may be placed on a user's device until they have given prior informed consent.

The GDPR — sets out how that consent must be obtained: freely given, specific, informed, and unambiguous (Article 4(11)). Silence, inactivity, or pre-ticked boxes do not count (Recital 32).

The landmark case that defined what this means in practice was Planet49 (Case C-673/17), a 2019 Court of Justice of the EU ruling. Planet49, a German gaming company, used a pre-ticked checkbox during an online lottery signup to obtain cookie consent. The CJEU ruled this was invalid — active, affirmative consent is required. That ruling became the reference point for every enforcement action that followed.

In February 2025, the proposed ePrivacy Regulation — which would have replaced the Directive — was formally withdrawn. This means the Directive and GDPR continue to govern cookies across the EU, with each member state implementing them slightly differently. Harmonisation is not coming. Enforcement, however, is intensifying.

Mistake 1: Making Rejection Harder Than Acceptance

This is the most common violation we see — and the one that drew Google's €325 million fine in 2025.

The mistake: The "Accept All" button is large, prominent, and coloured. The "Reject" option is buried — either in a settings menu, in small grey text, or requires multiple clicks to reach.

Why it's illegal: GDPR Article 7 requires that consent be "freely given." The EDPB's Cookie Banner Taskforce (established 2021, findings published 2023) was explicit: a Reject All button must be as prominent and require as few clicks as the Accept All button. An asymmetric design where rejection is harder than acceptance makes consent inherently unfree.

How to fix it: Your first-layer banner — the one that appears immediately when someone visits your site — must have a clearly visible Reject All option at the same visual weight as Accept All. It cannot be in a smaller font. It cannot be grey while Accept is red or green. It cannot require clicking "Settings" before you can reject.

The mistake: Your website loads analytics scripts, advertising pixels, or social media widgets the moment the page loads — before the visitor has interacted with the banner at all.

Why it's illegal: The ePrivacy Directive requires prior consent. "Prior" means before the cookie is set. If Google Analytics fires the moment someone lands on your page, you have violated the law regardless of what your banner says. This is a technical implementation failure, and it is extremely common. Many website builders and WordPress themes have this problem by default.

How to fix it: Your consent management implementation must block all non-essential scripts from loading until the user makes an active choice. This is called "prior blocking" or "consent-gated loading." Most cookie management platforms (CookieYes, Cookiebot, Osano, etc.) implement this when configured correctly. Simply installing a banner plugin is not sufficient — you need to verify that scripts are actually being blocked.

You can test this yourself using your browser's developer tools. Open the Network tab, clear it, then load your website. Before clicking anything on the cookie banner, look for any calls to google-analytics.com, facebook.com/tr, or similar domains. If you see them — your banner is decorative, not functional.

Mistake 3: Vague or Missing Purpose Descriptions

The mistake: The banner says something like "We use cookies to improve your experience" or "We use cookies for analytics and personalisation" without specifying what that actually means.

Why it's illegal: Article 4(11) GDPR requires consent to be specific and informed. The Planet49 ruling further established that websites must disclose how long each cookie lasts and whether third parties can access the data it collects. Vague umbrella language does not constitute informed consent.

How to fix it: Your banner and your linked cookie policy must explain, for each category:

This doesn't need to be exhaustive on the banner itself — but it must be clearly accessible via a link, and the language must be plain enough that a non-technical person can make a genuine informed choice.

Mistake 4: No Granular Category Controls

The mistake: The banner offers only two options — Accept All or Reject All — with no ability to choose between categories (necessary, analytics, marketing, functional).

Why it's a problem: While a binary Accept/Reject is technically compliant with the minimum requirement, the EDPB's guidance strongly recommends granular controls, and several national DPAs (France's CNIL, Germany's DPAs) have issued guidance making this a best practice expectation. More importantly: it's bad for your users. Someone who would accept analytics but reject advertising cookies has no way to express that preference.

How to fix it: Structure your cookie consent into at least three categories:

Each non-essential category should have an independent toggle that defaults to OFF. Users should be able to accept some categories and reject others.

The mistake: Once a user accepts cookies, there is no obvious way for them to change their mind or withdraw their consent. The banner disappears and the settings are inaccessible.

Why it's illegal: Article 7(3) GDPR states that the data subject has the right to withdraw consent at any time, and withdrawal must be as easy as giving it. If accepting took one click on a banner, withdrawing must also be accessible with a similar level of effort.

How to fix it: You need a persistent, always-accessible way for users to manage their cookie preferences. The most common implementation is a small "Cookie Settings" or "🍪" icon in the footer that reopens the consent panel at any time. This link must be visible on every page — not just the homepage, and not just hidden in your privacy policy.

Bonus: The "Continued Browsing" Fallacy

Many older websites still have text that reads: "By continuing to use this site, you consent to our use of cookies."

This is definitively invalid. The Planet49 ruling explicitly addressed this. The EDPB confirmed it. Silence, continued browsing, and scrolling are not consent.

If this language is on your site, remove it immediately and replace it with a proper consent mechanism.

How to Check Your Own Banner in 5 Minutes

Here's a quick self-audit you can do right now:

  1. Open your website in a private/incognito tab (clears any existing consent decisions)
  2. Does a cookie banner appear? If not — you probably don't have one at all
  3. Is there a Reject option visible on the first screen? If it requires clicking Settings first — that's Mistake 1
  4. Open developer tools → Network tab → load the page before clicking anything. Do analytics or ad scripts appear? — That's Mistake 2
  5. Read the banner text. Does it name specific tools (Google Analytics, Facebook Pixel)? Does it say how long cookies last? — No? That's Mistake 3
  6. Can you select individual categories? Binary accept/reject only? — That's Mistake 4
  7. After accepting, can you find a way to change your preferences? Look in the footer. If there's nothing — that's Mistake 5

Or you can run our free GDPR audit tool and get a score in under 30 seconds.

What Fixing This Actually Costs

The good news is that cookie compliance is one of the cheaper and faster GDPR fixes. Most implementations can be completed in half a day:

The cost of not fixing it is harder to predict — but €325 million is a number that tends to focus the mind.

This article is for informational purposes and does not constitute legal advice.

Also read:

⚠️ This article is for informational purposes only and does not constitute legal advice. For complex compliance situations, consult a qualified data protection professional. GDPR and EU AI Act requirements are subject to ongoing regulatory guidance — verify current obligations with your legal adviser.