What are the fines for non-compliant cookie banners in the EU?

Fines for non-compliant cookie banners in the EU fall under GDPR enforcement, reaching up to €20 million or 4% of global annual turnover, whichever is higher, for serious violations like invalid consent. National data protection authorities issue these penalties based on factors like harm caused and cooperation. 

Recent examples include SHEIN’s €150 million fine issued by the French Data Protection Authority (CNIL) in September 2025 for cookie consent violations, including placing tracking cookies without valid consent, insufficient information in banners, and making refusal harder than acceptance.