Centralcar S.p.a. – Violation Found (Italy, 2025)
Centralcar was warned for not allowing users to reject cookies on its website. The company failed to provide a clear option for users to refuse non-essential cookies, which is crucial for user privacy. This case shows that businesses must ensure their cookie consent banners are compliant with privacy laws.
What happened
Centralcar's website did not include a proper option for users to reject non-essential cookies, violating GDPR rules.
Who was affected
Visitors to Centralcar's website who were unable to refuse non-essential cookies when browsing.
What the authority found
The Italian Data Protection Authority found that Centralcar's cookie banner did not collect valid consent, violating several GDPR articles.
Why this matters
This case underscores the importance of clear cookie consent mechanisms. Companies must ensure their cookie banners comply with legal standards to protect user privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 11 April 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA opened an ex officio investigation on the website of a car dealership (Centralcar S.p.a., the controller) with a focus on the cookie banner. The DPA found that the banner did include an option to reject non-essential cookies and did not allow for the expression of granular consent in relation to the types of cookies used. The DPA also found that the website used cookies for profiling purposes even though its privacy policy stated otherwise. The controller changed its cookie banner's design after the DPA notified it about the investigation. The DPA considered that the cookie banner did not offer a "reject" button or a similar option. This prevented visitors from browsing the website without accepting non-necessary cookies. On these grounds, the DPA found that the banner did not collect valid consent and held that the controller processed data unlawfully, in violation Articles 4(11), 5, 7, 24 and 25 GDPR as well as Article 122 d. lgs. 196/2003This the Italian implementation of Article 5(3) of the ePrivacy Directive.. The DPA also held that the controller violated Articles 12 and 13 GDPR by providing an inadequate cookie policy. The DPA issued a warning. In this regard, the DPA considered that the controller brought its cookie banner into compliance during the procedure.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Violations (4)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Art. 12, 13 GDPR
Users cannot select or deselect individual cookie categories; consent is presented as all-or-nothing.
Art. 4(11) GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Centralcar S.p.a. in IT
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Centralcar S.p.a. - Italy (2025). Retrieved from cookiefines.eu
Last updated: