- Enforcing jurisdiction
- Italy · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Centralcar S.p.a. – Violation Found (Italy, 2025)
Italy's data protection authority found that Centralcar S.p.a. did not provide a proper cookie consent banner on its website. This ruling is significant because it reinforces the requirement for clear consent mechanisms for cookies. Companies must ensure their cookie policies are compliant to protect user privacy.
What happened
Centralcar S.p.a. failed to provide a cookie banner that allowed users to reject non-essential cookies.
Who was affected
Visitors to Centralcar S.p.a.'s website who were affected by the inadequate cookie consent mechanism.
What the authority found
The authority ruled that the cookie banner did not collect valid consent, violating multiple GDPR articles.
Why this matters
This decision highlights the importance of having clear and compliant cookie consent mechanisms. Companies must ensure that users can easily manage their cookie preferences to protect their privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 11 April 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA opened an ex officio investigation on the website of a car dealership (Centralcar S.p.a., the controller) with a focus on the cookie banner. The DPA found that the banner did include an option to reject non-essential cookies and did not allow for the expression of granular consent in relation to the types of cookies used. The DPA also found that the website used cookies for profiling purposes even though its privacy policy stated otherwise. The controller changed its cookie banner's design after the DPA notified it about the investigation. The DPA considered that the cookie banner did not offer a "reject" button or a similar option. This prevented visitors from browsing the website without accepting non-necessary cookies. On these grounds, the DPA found that the banner did not collect valid consent and held that the controller processed data unlawfully, in violation Articles 4(11), 5, 7, 24 and 25 GDPR as well as Article 122 d. lgs. 196/2003This the Italian implementation of Article 5(3) of the ePrivacy Directive.. The DPA also held that the controller violated Articles 12 and 13 GDPR by providing an inadequate cookie policy. The DPA issued a warning. In this regard, the DPA considered that the controller brought its cookie banner into compliance during the procedure.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Violations (3)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Users cannot select or deselect individual cookie categories; consent is presented as all-or-nothing.
Related Enforcement Actions (0)
No other enforcement actions found for Centralcar S.p.a. in IT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Centralcar S.p.a. - Italy (2025). Retrieved from cookiefines.eu
Last updated: