Laws and fines

Cookie banner law: what you need to avoid a complaint

When cookie consent is required, what a lawful banner looks like, and why the Reject button matters more than it seems.

Checked against sources: 30 September 2026

  • €150MCNIL fine on Google, 2022
  • €60MCNIL fine on Facebook, 2022
  • €100for Google Fonts, Munich court

When consent is mandatory

In the EU you need consent for every cookie the site can work without: analytics, ads, social pixels, session replay. Shopping carts and logins need no question. A visit counter does.

In Planet49 (2019) the EU Court of Justice ruled that a pre-ticked box is not consent. Silence and scrolling are not consent either.

What a lawful banner looks like

  • “Accept” and “Reject” are the same size and equally visible.
  • Analytics and ads do not load until the visitor chooses.
  • Categories are selectable: necessary, analytics, advertising.
  • Rejecting really switches scripts off, not just hides the banner.
  • The choice can be changed later from the footer.

What you risk

In January 2022 the French regulator CNIL fined Google €150M and Facebook €60M because refusing cookies was harder than accepting them.

For an ordinary site the risk is different: a visitor’s complaint, an inquiry and a GDPR fine. Amounts are in the fines guide.

Check yourself in two minutes

Open the site in an incognito window and leave the banner alone. The Network tab must show no requests to Google Analytics, Yandex Metrica or ad networks. Click Reject and reload: nothing should change.

Awe Check does the same by itself: it records requests before consent, clicks Reject and checks again.

Frequently asked

Does a site in Kazakhstan or Russia need a banner?

Cookies are not named in those laws, but consent to processing personal data is required, and visitor identifiers are treated as such in practice. So Awe Check asks for separate consent for analytics and ads everywhere except the US, which works on an opt-out model.

Can I load Google Fonts from Google servers?

It is risky for EU visitors. In January 2022 a Munich court awarded a visitor €100 because their IP address went to Google along with the font. Host the fonts yourself.

Sources

Check your site

Awe Check shows in a minute which of this is broken on your site and calculates the possible fine.

Check a site