European GDPR & Cookie Compliance Observatory
Ce que votre bannière affiche ne dit rien de ce que votre réseau transmet ni de son accessibilité légale. Fuites de traceurs avant consentement et non-conformité WCAG 2.2 / EN 301 549 : le défaut d'accessibilité frappe de nullité votre consentement et déclenche la double sanction DGCCRF (150 k€) et CNIL (4% du CA).
Technical Counter-Audit & Simulator
1. What is your technical stack / CMS?
Cookie enforcement barometer: what authorities actually decided
A synthesis of decisions published by the CNIL, the Irish DPC and European courts. Every amount links to its official decision or press release. No proprietary statistics, no internal estimates.
83 decisions totalling €486,839,500 across all subject matters. Official CNIL report
CNIL, 3 September 2025, ads inserted between emails without consent. CNIL decision
Reference decisions by vendor
Sources: CNIL, DPC, Légifrance| Vendor | Authority & date | Amount | Reason | Source |
|---|---|---|---|---|
| Google LLC & Google Ireland Ltd. | CNIL — 7 déc. 2020 / 13 janv. 2022 | 100 M€ / 150 M€ | Cookies set without consent, refusal made difficult (SAN-2020-012, SAN-2022-001) | CNIL decisions |
| Meta Platforms Ireland Ltd. | CNIL — 13 janv. 2022 | 60 M€ | Cookie refusal path more complex than acceptance (SAN-2022-002) | CNIL decision |
| Amazon Europe Core | CNIL — 7 déc. 2020 | 35 M€ | Advertising cookies set without consent, insufficient information (SAN-2020-013) | CNIL decision |
| TikTok / ByteDance | CNIL — 12 janv. 2023 | 5 M€ | No refusal button as simple as acceptance (SAN-2022-027) | Décision |
| Criteo SA | CNIL — 15 juin 2023 | 40 M€ | Behavioural retargeting without consent, access and withdrawal rights (SAN-2023-009) | Légifrance |
| LinkedIn Ireland | DPC (Irlande) — 24 oct. 2024 | 310 M€ | Legal bases for behavioural advertising | DPC press release |
Retention reference rule: the CNIL recommends a maximum cookie lifespan of 13 months and keeping the user's choice for 6 months. None of these amounts is a forecast for your own situation.
European Accessibility Act 2026: The Web Accessibility Barometer
For enterprises over 10 staff or €2M turnover, commercial digital services (e-commerce, SaaS, banking, transit) must satisfy EN 301 549 (WCAG 2.2 AA). Inaccessible architecture voids GDPR consent ab initio. Explore our 4 forensic investigations and compliance toolkits.
The Legal Guillotine: Consent Void Ab Initio
Why sensory inaccessibility invalidates collected consent tokens retroactively and triggers joint market surveillance (€150k) and DPA (4% turnover) fines.
0 Out of 5 CMPs WCAG 2.2 Compliant Out-of-the-Box
OneTrust, Didomi, Axeptio, Cookiebot, Tarteaucitron: Headless Chromium crash test under Axe-Core 4.9 and CDP accessibility tree audits.
Reject Button Contrast: 2.3:1 Ratio Dissection
Mathematical autopsy of chromatic deception: how 42% of production CMPs suppress the Reject button far below the legal 4.5:1 threshold.
25-Point EN 301 549 & WCAG 2.2 Audit Checklist
The statutory evaluation matrix defensible before European market regulators and DPAs. Includes automated Playwright audit suites.
Concrete Strategies for Every Professional
Whether you manage an e-commerce brand, a web agency, or group data governance, CookieDetox provides clear, actionable protocols.
Safeguard Your ROAS Without DPA Sanctions
Properly block Meta Pixel and TikTok prior to opt-in while implementing Google Consent Mode v2 to model unconsented conversions.
- Shopify & WooCommerce compliance SOPs
- Advanced Consent Mode v2 correctly configured
- No impact on visitors who consented
Zero-Liability Assurance for Client Delivery
Prevent contract disputes and agency liability in case of DPA audits on client websites. Audit and ship 100% compliant stacks in 15 minutes.
- Contractual liability protection clauses
- Forensic PDF audit report upon project handover
- Verified CMP templates (Axeptio, Didomi, Klaro)
Forensic Audits & Court-Ready Evidence
Export technical reports detailing each cookie, its lifespan, domain provenance, and exemption status for your official GDPR records.
- Cryptographic timestamped proof logs
- Piggybacking & third-party script mapping
- Standard response templates for DPA inquiries
Choosing a CMP: the four criteria that actually matter
First-layer refusal parity, Google Consent Mode v2 support, script-blocking mechanism and billing model. Each cell states what to verify on your own site — no prices are published here, because a price changes and cannot be verified remotely. No rating is assigned to any vendor.
| CMP Platform | Billing model | First-layer refusal | Consent Mode v2 | What to verify | Dedicated Review |
|---|---|---|---|---|---|
| Axeptio | Traffic-based tiers | Supported natively | Documentation GTM | Which scripts fire before the click, on your site | Read the analysis → |
| Didomi | Enterprise, quote-based | Configuration-dependent | IAB TCF v2.2 | Actual SDK weight and declared vendors | Lire l'analyse → |
| Cookiebot | Per indexed domain | Selon configuration | Documented support | Actual parity of the shipped banner | Lire l'analyse → |
| Klaro / Tarteaucitron | Open source, no licence fee | To be implemented | Manual script | Script blocking before consent | Lire l'analyse → |
| OneTrust | Enterprise, sur devis | Selon configuration | Support documenté | Script weight and multi-site governance | Lire l'analyse → |
Latest Investigations & Case Law
B2B SaaS & Web Apps: EAA 2026 Accessibility Compliance Guide
Architectural and legal guide to achieving EN 301 549 & EAA 2026 compliance for B2B SaaS applications. Data grids, dataviz, focus traps, PDF/UA, and Playwright tests.
Sep 22, 2026Shopify Cookie Compliance & DPA Fines: Forensic Risks and Engineering Guide
Avoid severe GDPR & DPA fines on your Shopify store. Technical breakdown of native theme traps, undeclared app scripts (Klaviyo, Meta Pixel, TikTok), missing layer-1 reject buttons, and complete 2026 compliance audit checklist.
Sep 21, 2026Mandatory Digital Accessibility Statement (EAA 2026): Legal Framework, Valid Template & Non-Compliance Penalties
Technical and legal guide to the mandatory Digital Accessibility Statement under EAA 2026 & national transpositions: homepage disclosures, fines up to €50,000, multi-year schematics, and production-ready HTML/JSON-LD templates.
Sep 20, 2026Automated Regulatory Cookie Audits: How DPA Headless Crawlers Inspect Web Traffic and Issue Fines
Forensic breakdown of automated online GDPR cookie inspections by European DPAs (CNIL, AEPD, Garante, ICO). How regulatory crawlers inspect network packets, issue formal notices, and levy fines.
Sep 19, 2026How Regulatory Web Crawlers Audit Sites: The 5 Automated DPA Tests You Must Pass
Data protection authorities use automated headless crawlers to scan websites for GDPR violations. Discover the 5 automated tests and how to pass them.
Sep 18, 2026Accessibility Overlays and Widgets: The Technical Illusion Crashing Against EAA 2026 Enforcement
Technical and legal teardown of accessibility overlays (AccessiBe, UserWay, Facil'iti). Discover why scripts fail EAA 2026, EN 301 549, and invite regulatory fines.
Sep 18, 2026How to Fix 'Consent Not Configured' in Google Ads: GTM Audit & Network Decoding
Resolve the 'Consent not configured' warning in Google Ads. 2026 technical guide: decoding gcs (G100, G111) and gcd network flags, fixing GTM race conditions, and recovering Smart Bidding conversion modeling.
Sep 15, 2026E-Commerce Checkout Accessibility: EAA 2026 Audit & Remediation Guide
Technical and legal guide to EAA 2026 compliance for e-commerce checkouts: EN 301 549 and WCAG 2.2 AA implementation for carts, forms, 3D Secure, and payment iframes.
Sep 15, 2026Cookie Lifespans: The 6-Month Choice Renewal vs 13-Month Tracker Rule Explained
Master CNIL 6-month consent retention vs 13-month cookie lifespans. Technical audit, gtag.js configuration, and regulatory enforcement criteria.
Sep 12, 2026CMP Accessibility Audit Checklist: 25 Verification Points for EN 301 549 & WCAG 2.2
Exhaustive 25-point accessibility audit checklist for CMPs under EN 301 549 and WCAG 2.2. Verify keyboard traps, screen readers, contrast, and GDPR validity.
Sep 11, 2026Cookie Compliance for Fintech & Banking: Fraud Prevention Tracker Exemptions & Security Rules
PSD2 SCA vs GDPR ePrivacy compliance for banking. Exemption criteria for fraud tokens, behavioral biometrics, device fingerprints, and ACPR/CNIL rules.
Sep 9, 2026Dark Mode & Cookie Banners: The Silent Disaster of Inverted Contrast Ratios
Dark mode uncalibrated CMPs trigger catastrophic contrast drops below 1.8:1, breaching GDPR Art. 4(11), WCAG 2.2, and the European Accessibility Act.
Sep 9, 2026Proof of Consent: Generating Tamper-Proof Cryptographic Consent Receipts for DPA Audits
Architect tamper-proof consent receipts under GDPR Art. 7(1). Eliminate transient cookie proofs with immutable HMAC-SHA256 logging for DPA audits.
Sep 6, 2026Mobile Cookie Banners on iOS & Android: The Massive Failure of WCAG 2.2 Target Size (24x24px)
Technical audit of mobile cookie banners: why sub-24px tap targets and viewport clipping violate WCAG 2.2 SC 2.5.8, the EAA, and GDPR consent validity.