About Cookie Fines
Published privacy enforcement records, with Europe as the default and worldwide collection held in source review.
Source coverage and publication
Europe is the default public selection. Region, confirmed legal basis and subject are independent filters. Only confirmed EU GDPR cases count toward GDPR totals; UK GDPR and other laws remain separate.
Worldwide publications remain in source review, even after an assessment is completed. Collection does not mean publication. Register coverage and historical access vary, and a registered source does not establish a successful daily retrieval or complete coverage.
Fines, settlements and other payments are separate. Shared payments are counted once through their reviewed attribution. Counts describe published case records, including non-fine outcomes.
The CRTC collection uses its official feed; the full register and historical coverage remain restricted.
- New Jersey Attorney GeneralNew Jersey, United States · privacy enforcement announcements · Official collection source
- Illinois Attorney GeneralIllinois, United States · privacy enforcement announcements · Official collection source
- Washington Attorney GeneralWashington, United States · privacy enforcement announcements · Official collection source
- Connecticut Attorney GeneralConnecticut, United States · privacy enforcement announcements · Official collection source
- New York Attorney GeneralNew York, United States · privacy enforcement announcements · Official collection source
- PIPC South KoreaSouth Korea · Article 66 administrative disposition results · Official collection source
- SEC United StatesUnited States · privacy-related enforcement announcements · Official collection source
- PPC JapanJapan · published administrative privacy actions and follow-ups · Official collection source
- IPC SaskatchewanSaskatchewan, Canada · published privacy-related reports · Official collection source
- IPC OntarioOntario, Canada · health, privacy and child/youth/family decisions · Official collection source
- OIPC Nova ScotiaNova Scotia, Canada · privacy and investigation reports · Official collection source
- ANTAI PanamaPanama · published personal data protection resolutions · Official collection source
- NPC PhilippinesPhilippines · published Decisions and Resolutions · Official collection source
- ADGM Office of Data ProtectionAbu Dhabi Global Market, UAE · data protection regulatory actions · Official collection source
- OVIC VictoriaVictoria, Australia · published individual privacy investigations · Official collection source
- OIPC Newfoundland & LabradorNewfoundland & Labrador, Canada · published privacy reports · Official collection source
- New York DFSNew York, United States · privacy and personal-data security enforcement · Official collection source
- DPO MauritiusMauritius · anonymised complaint decisions · Official collection source
- Manitoba OmbudsmanManitoba, Canada · privacy and personal health information · Official collection source
- SPDP EcuadorEcuador · published sanction-proceeding resolutions · Official collection source
- Cayman Islands OmbudsmanCayman Islands · data protection decisions and informal resolutions · Official collection source
- URCDP UruguayUruguay · published complaint resolutions · Official collection source
- CFPB United StatesUnited States · privacy, consumer reporting and data security · Official collection source
- OPC New Zealand · Decision notesNew Zealand · compliance decision notes · Official collection source
- OIPC British ColumbiaBritish Columbia, Canada · privacy reports and Orders · Official collection source
- ODPC KenyaKenya · privacy determinations · Official collection source
- ANPD BrazilBrazil · LGPD supervision and sanction proceedings · Official collection source
- PCPD Hong KongHong Kong · privacy enforcement reports · Official collection source
- ANPD PeruPeru · personal data protection proceedings · Official collection source
- California AGCalifornia, United States · privacy enforcement · Official collection source
- Information Regulator South AfricaSouth Africa · POPIA enforcement · Official collection source
- AAIP ArgentinaArgentina · sanctions register updates · Official collection source
- OPC CanadaCanada · business and federal privacy · Official collection source
- OPC New ZealandNew Zealand · privacy case notes · Official collection source
- TraficomFinland · Official collection source
- PTSSweden · Official collection source
- ICOUnited Kingdom · Official collection source
- CNILFrance · Official collection source
- CalPrivacy / CPPACalifornia, United States · Official collection source
- ACMAAustralia · Official collection source
- HHS OCRUnited States · health privacy · Official collection source
- PDPCSingapore · Official collection source
- CRTCCanada · spam and telemarketing · Official collection source
- FTCUnited States · privacy and security · Official collection source
- OAICAustralia · privacy · Official collection source
What is Cookie Fines?
Cookie Fines is an open-source project that collects, categorizes, and analyzes enforcement actions related to cookie consent, tracking, and broader privacy compliance across different jurisdictions. Region, confirmed legal basis and subject are recorded separately.
We track over 432 enforcement actions spanning 29 countries, including fines, court rulings, CJEU precedents, complaints, warnings, and orders. Of these, 0 cases are specifically classified as cookie consent enforcement, within the current public selection. This is a sourced dataset, not a complete inventory of worldwide enforcement.
Our goal is to provide transparency into how Data Protection Authorities (DPAs) enforce cookie and data protection regulations, helping businesses understand the real consequences of non-compliance and prioritize their privacy efforts.
Data Sources
All data is sourced from authoritative, publicly available enforcement databases and DPA publications:
Community-driven wiki cataloguing GDPR decisions, case law, and enforcement actions across all EU/EEA member states. Our primary data source.
Comprehensive GDPR fine database provided by CMS Law.Tax — one of Europe's largest law firms. Provides structured fine data with legal analysis. Data used under CC BY-NC-SA 4.0; attribution: enforcementtracker.com, provided by CMS Law.Tax.
French Data Protection Authority - the most active European DPA on cookie enforcement, responsible for landmark cases against Google and Meta.
Spanish Data Protection Authority - one of the most active DPAs in Europe by volume of enforcement actions.
Data Collection & Update Frequency
Data is collected and updated through a fully automated pipeline:
- Automated scrapers run daily to check GDPRhub, CMS Enforcement Tracker, and individual DPA websites for new enforcement actions.
- Deduplication engine matches new records against existing data using company name, country, date, and amount to prevent duplicates across sources.
- Classification pipeline assigns subject categories. A subject or article citation does not confirm a legal basis; confirmed legal assessments are recorded separately.
- AI verification (GPT-4o) provides cookie relevance scoring (0-100) for borderline cases, supporting scope classification; outputs can contain errors.
- Data normalization standardizes company names, authority references, GDPR article citations, and currency amounts across all sources.
New enforcement actions are typically added within 24-48 hours of publication by the relevant DPA or court.
Data Quality & Source Checks
Source retrieval: records whether text was obtained from a linked source, secondary summary or archive. Retrieval alone does not validate the facts or identify the text as an original decision.
Automated check: records a pipeline attempt and its reported outcome. A timestamp may exist even when parsing failed, source text was unavailable, or discrepancies remain.
Independent review: is separate from automated checks. These automated statuses do not establish a human or legal review. Targeted corrections concern the specific reviewed fields, not certification of the entire record.
Review needed: includes unresolved amount/date/entity flags, failed checks, missing outcomes and insufficient source evidence. An automated “no issues” result is not a guarantee of accuracy.
- Case summaries - imported summaries help explain records; they are not substitutes for the full decisions
- Multi-source validation - records from GDPRhub and Enforcement Tracker can be cross-referenced; this does not establish verification of every record
- AI-assisted classification - automated cookie relevance scores support classification and can require correction
- 10 classified violation types - cookie-specific violations tagged with severity ratings
- Structured GDPR articles - article citations parsed and normalized across all records
- Source URLs preserved - every record links back to its original DPA publication or GDPRhub page
Risk Calculator Methodology
Our risk calculator uses a data-driven percentile model based on real enforcement data, not theoretical revenue-based formulas.
How it works
- We query all cookie-consent fines with a positive amount from the database (currently 0 cases across 0 countries).
- We filter by your selected violations (95% of fines are tagged with specific violation types).
- We narrow to your country if there are enough matching cases (3+), otherwise we use the full European dataset.
- We calculate the statistical distribution and return the 25th-75th percentile range as the “likely” estimate, with the 10th-90th percentile as the extended range.
Why not a formula?
Formula-based calculators (using revenue x percentage x multipliers) typically over-estimate cookie fines by 10-50x. In reality, the majority of cookie fines are well under EUR 100,000 and most fines are fixed amounts, not percentages of revenue.
Limitations
- Some countries have very few cookie-specific fines, making country-level estimates less reliable.
- Revenue data is not available for most fined companies, so we cannot model revenue-based variation.
- The database covers publicly reported enforcement actions; sealed settlements may not be included.
How to Cite This Database
This database is freely available for research and journalism (non-commercial use only), in accordance with the CC BY-NC-SA 4.0 licence of the underlying data sources. When citing, please use:
Data exports are available on the Statistics page. If you redistribute this data, you must do so under the same CC BY-NC-SA 4.0 licence.
Data Licence
All enforcement data in this database is published under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) licence, in compliance with the licensing terms of our upstream data sources.
This means you may:
- Share — copy and redistribute the data in any medium or format
- Adapt — remix, transform, and build upon the data
Under the following conditions:
- Attribution (BY) — you must give appropriate credit to both Cookie Fines and the original data source (GDPRhub or CMS Enforcement Tracker)
- NonCommercial (NC) — you may not use the data for commercial purposes
- ShareAlike (SA) — if you remix or build upon the data, you must distribute your contributions under the same CC BY-NC-SA 4.0 licence
The source code of this website is licensed separately under the MIT licence. The data licence (CC BY-NC-SA 4.0) applies to the enforcement data content only.
Disclaimer
This database is provided for informational and educational purposes only. It does not constitute legal, financial, or compliance advice. The risk calculator provides statistical estimates based on historical data and should not be relied upon as a prediction of actual enforcement outcomes.
Data is aggregated from publicly available sources and may contain inaccuracies. AI-generated summaries may not perfectly reflect official DPA decisions. Always consult with qualified legal professionals for specific compliance guidance.
Read our full Disclaimer and Privacy Policy.
Project Transparency
Cookie Fines is an independent, non-commercial, open-source project focused on increasing transparency in privacy enforcement. The project is not affiliated with any DPA, law firm, or compliance vendor.
Data Freshness
Automated scrapers run daily. The database currently contains 432 enforcement actions across 29 countries, with the largest tracked fine being €525K against locatefamily.com (Netherlands).
Methodology
The pipeline imports, classifies and normalizes records and attempts automated source checks. Completion and evidence vary by record. Source links may lead to regulator documents or secondary summaries; consult them and any reported discrepancies before relying on a record.
Last enforcement record change: 19 October 2026 · Based on stored record changes; scheduled imports may add no new data.
Frequently Asked Questions
Where does the data come from?
Cookie Fines aggregates published enforcement records from GDPRhub, CMS Enforcement Tracker and data protection authority publications.
Does an automated check establish independent legal review?
No. Imported and automatically processed information may contain errors. Consult the linked sources and reported limitations before relying on a record.