GDPR fines in 2026: what the latest decisions mean for your website

GDPR fines are set by each country’s data protection authority under Article 83 of the GDPR, in two tiers: up to €10 million or 2% of a company’s worldwide annual turnover, and up to €20 million or 4% for the most serious infringements, whichever is higher. This autumn’s decisions about websites are mostly about cookies, consent and marketing, not the giant transfer cases. And on 16 October 2026, France’s highest administrative court upheld Orange’s €50 million sanction, including the part about cookies that were still read after visitors withdrew their consent.

Here’s what’s in this one. How the fines are set, in the EU and the UK. What the Conseil d’État said about Orange, and what Orange had already fixed. What Ireland fined Google for in September. What the CNIL fines small websites for, when nobody’s name is published. Two more decisions, on security and on marketing emails. Then the pattern they share, and a check you can run on your own site from a phone.

How GDPR fines are set

The ceilings are in Article 83. The lower tier, up to €10 million or 2% of total worldwide annual turnover for the preceding year, covers obligations like security and record keeping. The higher tier, up to €20 million or 4%, covers the principles, the legal bases including consent, people’s rights and transfers abroad. That’s the answer to “what is the maximum fine for GDPR non compliance”: whichever of the two figures is higher, in the tier that applies.

The ceiling isn’t the price. Article 83(2) tells the authority what to weigh: how serious the infringement was and how long it lasted, how many people were affected, what the company did to limit the harm, how well it cooperated. Each EU country has its own authority. When a company works across borders, the authority where it has its main EU base leads. That’s why Ireland’s DPC decides Google’s cases, as lead supervisory authority.

There’s a catch that matters for websites. Many “cookie fines” aren’t GDPR fines in law. The rule on storing and reading cookies comes from the EU’s ePrivacy directive, and each country writes it into its own law. In France that’s article 82 of the Data Protection Act, which the Conseil d’État describes as transposing article 5(3) of the directive. People still search for these as GDPR fines, and the CNIL still sets the amount with the GDPR’s criteria, so they belong here. Just know which law is doing the work.

The UK kept the same structure after Brexit. A UK GDPR fine can reach £8.7 million or 2% in the lower tier, and £17.5 million or 4% in the higher one, whichever is higher. Cookies and marketing texts and emails sit in a separate law, PECR, and the ICO enforces both. The UK side of Orange’s lesson, what has to stop after someone says no, is in the Handbook at UK-04.

Orange: the appeal it lost this month

The CNIL fined Orange on 14 November 2024 for two things. First, Mail Orange showed adverts that looked like emails among the real emails in people’s inboxes, without their consent. That fell under the French telecoms code, article L.34-5. Second, when visitors to orange.fr withdrew their consent to cookies, the cookies already stored were still read by Orange and its partners. That fell under article 82.

To be plain about it: neither finding is a GDPR infringement. The cookie part is French ePrivacy law and the email adverts are the telecoms code, both enforced by the CNIL.

The CNIL said it didn’t matter whether anything was done with the data afterwards. Reading what’s stored on someone’s device is explicitly prohibited by Article 82 of the French Data Protection Act, even if this data is not subsequently used. The fine took account of the more than 7.8 million people who saw the adverts, Orange’s place as France’s leading telecoms operator and the money it made from the adverts. It came with an order to stop reading cookies after withdrawal within three months, at €100,000 a day if it didn’t.

Orange appealed. The Conseil d’État decided on 16 October 2026, in case no. 501268, and its operative line is short: La requête de la société Orange est rejetée. The application is rejected.

On cookies, Orange had argued that the reading led to no later use of the data and touched only a small share of visitors. The court found that cookies written on visitors’ devices could still be read by Orange or its partners after consent was withdrawn. Since nobody disputed that reading, whether the data was processed afterwards made no difference to the finding.

On the amount, the court noted that €50 million was 0.11% of Orange’s worldwide turnover for the previous year and found it wasn’t disproportionate. It also said the CNIL doesn’t have to split one fine between breaches of different laws, and doesn’t have to send a warning before opening sanction proceedings.

What Orange changed is the useful part, and the CNIL wrote it down when it closed the order on 11 September 2025. A script now deletes Orange’s own cookies on the .orange.fr domain when someone withdraws. For partner cookies, Orange stops sending any new requests to the partners’ domains. The CNIL noted that these cookies were not removed from the browser, so a partner could still follow the person on other sites. It put that reading on the partners, not Orange, and didn’t collect the daily penalty. Where that line falls for a small shop running one ad partner’s tag, the CNIL didn’t say, and I haven’t seen a decision that does.

Google in Ireland: what the DPC found about location data

On 21 September 2026 the Irish DPC fined Google €403 million in total. The inquiry looked at three features, Web & App Activity, Location History and Location Accuracy, from May 2018 to February 2020.

The DPC found four kinds of infringement: the lawfulness and fairness of the location processing in two of the features, accountability in the third, transparency in all three, and keeping location data too long in two. Google has six months to bring the processing into line, and the full decision is still to be published.

Deputy Commissioner Graham Doyle put the harm simply. individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests. And on retention: The retention of users’ location data for longer than necessary aggravated this loss of control.

It’s not a website case, but there’s one thing in it for your site. Your privacy notice has to say what you collect, what for, and how long you keep it. The privacy policy example walks through what goes in one.

GDPR fines for small websites: the CNIL’s simplified sanctions

This is the one that teaches most, and it has no company names in it. Since 2022 the CNIL has had a simplified procedure for cases with no tricky legal question. One member decides, the fine can’t go above €20,000, and the CNIL can’t publish who it fined.

On 6 July 2026 it reported 23 of these since January, €133,750 in total. Nineteen started with a complaint. Most were about video surveillance, cookies, and access and erasure requests.

The cookie findings came from the CNIL checking several websites online, including online ticket sellers and telemarketing firms. Some banners didn’t explain what the cookies were for or how to refuse or withdraw. Some sites set cookies that need consent, advertising cookies for example, before the visitor did anything. And some banners had a button to accept everything at once, while refusing meant clicking “personnaliser” and switching things off one by one in another screen. The CNIL’s rule is short: if you can accept all in one click, you must be able to refuse all in one click. The cookie banner examples show what that looks like.

Eight of the 23 were about access or erasure requests, four of them with a failure to cooperate with the CNIL. Some companies didn’t answer at all; others took too long. Some lawyers and doctors who ignored the CNIL’s own letters got a fine plus an order to answer the complainant, and paid a penalty when they still didn’t. If you’ve never handled one of these requests, what a DSAR is is a good place to start.

Security and marketing: two more decisions to know

Free and Free Mobile, CNIL, January 2026

If you searched for a GDPR breach fine, this is this year’s clearest one. In October 2024 an attacker got into the systems of Free and Free Mobile and reached data on 24 million subscriber contracts, including bank account numbers for people who were customers of both. More than 2,500 people complained. In January 2026 the CNIL fined Free Mobile €27 million and Free €15 million.

It found three things. Under Article 32, basic security measures were missing: the VPN that staff used to work remotely didn’t have robust enough authentication, and the tools meant to spot unusual activity didn’t work. Under Article 34, the email telling people about the breach left out information they needed to understand what had happened and how to protect themselves. And Free Mobile kept millions of former subscribers’ records for too long. Both companies have three months to finish the new security measures; Free Mobile has six months to finish sorting and deleting old data.

Altroconsumo Edizioni, Garante, July 2026

Italy’s Garante fined Altroconsumo Edizioni €280,000 in a decision of 18 June 2026, announced on 29 July. One complaint started it: someone kept getting promotional emails though they’d never filled in the membership form, and had already asked for them to stop.

The Garante found that when people started signing up on altroconsumo.it and then decided not to confirm the account, the company treated the contract as made anyway and sent them marketing emails. It had also been slow to answer rights requests, and had been sanctioned for that once before. The decision rests on Articles 6, 7 and 21 of the GDPR and article 130 of the Italian privacy code. Altroconsumo has to stop using the data of people who never confirmed. If you’re unsure where consent for your newsletter begins, the opt in vs opt out post covers it.

What the decisions have in common

Take out the company names and the amounts and the same few things keep turning up.

A choice that doesn’t do what it says. Orange’s visitors withdrew and their cookies were still read. Altroconsumo’s visitors didn’t confirm and got emails anyway. In both, the person said no and the system carried on as if they’d said yes.

A refusal that takes longer than a yes. One button to accept, a trip through “personnaliser” to refuse. The CNIL keeps fining this, on small sites and on Google’s account sign-up alike.

A notice that leaves something out. Google’s users could have been unaware of how their location was used, and it was kept too long. Free’s customers got a breach email that didn’t tell them what to do. Some of the banners in the simplified sanctions didn’t say what the cookies were for.

The biggest GDPR fines are a different list, mostly data sent abroad and the largest platforms. The record is still the €1.2 billion Meta Ireland fine of May 2023 over transfers to the US. For the rest of what the GDPR asks of a site, the GDPR compliance checklist is the long version, and if you sell to the UK or US, CMA fines and CCPA fines cover this autumn’s decisions there. This is a summary of what the authorities decided, not legal advice for your own case.

Check your cookie choices from a phone

You need ten minutes and your phone. No tool.

1. Clear what your site has already stored. On an iPhone, go to Settings, Apps, Safari, Advanced, Website Data, search for your domain and delete it. In Chrome on Android, open your site, tap the icon at the left of the address bar, then Cookies and site data, and delete.
2. Open your home page fresh and look at the banner. Count the taps to accept everything. Clear the data again, reload, and count the taps to refuse everything. If refusing takes more, that’s the “personnaliser” pattern.
3. Accept everything and visit two or three pages. Then check the site data again: on Android, the same Cookies and site data screen; on an iPhone, the Website Data list, where any other domain that stored data shows up next to yours.
4. Now withdraw. Find the link in your footer, or the small icon some banners leave behind, and switch everything off. Can you find it in under a minute? If not, neither can your visitors.
5. Reload and look again. Orange’s fix deletes its own cookies on withdrawal and stops calling its partners. If your list looks exactly as it did after you accepted, ask whoever set up your banner what happens on a no. The check website cookies guide goes deeper on a laptop.
6. From the footer, open your privacy notice. Look for two things: who receives visitors’ data, and how long you keep it. If either is missing, add it. The types of website cookies post helps you name what you found.

Peeky reads your public pages for the same patterns. For a refusal or withdrawal that doesn’t stop the tracking, the check is EU-02, where he notes what keeps loading after a visitor says no. For a refusal that takes more effort than accepting, it’s EU-03, where he compares the two paths on the banner. And for the security side of the Free case, EU-15 covers whether your pages load over HTTPS and which security headers your server sends.

Questions people ask

What is the maximum fine for severe GDPR violations?

Under Article 83(5) of the GDPR, up to €20 million or, for a company, up to 4% of total worldwide annual turnover for the previous financial year, whichever is higher. That tier covers the principles, consent, people's rights and transfers. Other obligations, such as security, sit in the lower tier: €10 million or 2%. Authorities set the actual amount case by case, so most fines land far below the ceiling.

What are the fines imposed in the UK for data protection breaches?

The UK GDPR keeps the same two tiers in pounds: up to £8.7 million or 2% of worldwide turnover, and up to £17.5 million or 4% for the more serious infringements, whichever is higher. The ICO decides each amount. Cookies and marketing messages fall under a separate law, PECR, which the ICO also enforces.

What are the biggest GDPR fines ever imposed?

The top of the list is about data sent abroad and very large platforms, not ordinary websites. The largest single one is the Irish DPC's €1.2 billion fine on Meta Ireland in May 2023, for transfers of Facebook users' data to the US. This autumn the DPC added €403 million against Google over location data.

Can a small business get a GDPR fine?

Yes. France's CNIL runs a simplified procedure for straightforward cases. Between January and early July 2026 it issued 23 of these sanctions, totalling €133,750, and 19 started with a complaint. Each is capped at €20,000 and the name isn't published. They covered cookie banners, unanswered access and erasure requests, and cameras filming staff all day.

Can you be fined for cookies under the GDPR?

You can be fined for cookies, though usually not under the GDPR itself. In France the cookie rule is article 82 of the Data Protection Act, which comes from the ePrivacy directive, and the CNIL fines under it. The UK uses PECR. The GDPR comes in for what's done with the data afterwards.