Cookie Banners in 2026: Why Symmetrical Buttons Are No Longer Enough
For about four years the working definition of a compliant cookie banner was visual. Make the reject button as prominent as the accept button, do not pre-tick anything, and do not use a dark grey link where the other option is a coloured rectangle. Symmetry became the test because symmetry is what a screenshot can prove.
Two decisions published by the French data protection authority in September 2025 moved the test somewhere a screenshot cannot reach. The question is no longer what the banner looks like. It is what the site does after the visitor has clicked.
What the CNIL actually decided
On 3 September 2025 the CNIL published two restricted committee decisions. They are available in English on the regulator’s own site, which is where you should read them rather than in press coverage, because the operative findings are narrower and more useful than the headlines.
| Case | Amount | Entities | Core finding |
|---|---|---|---|
| SHEIN | EUR 150 million | INFINITE STYLES SERVICES CO. LIMITED, the Irish subsidiary | Cookies written on arrival before any interaction, and refusal not honoured afterwards |
| EUR 325 million | EUR 200 million against Google LLC and EUR 125 million against Google Ireland Limited | Advertising inserted between Gmail messages without consent, and cookies set at account creation |
The figure that circulated most widely was 200 million for Google. That is one of the two components. The total is EUR 325 million, split across two legal entities in one decision, and quoting only the larger component understates the penalty by 38%.
The SHEIN finding is the one that changes your build
Read the CNIL’s summary of the SHEIN decision and three separate defects appear, only one of which is about the banner’s appearance.
- Cookies were placed on arrival. Several trackers, including advertising ones, were written to visitors’ devices as soon as they landed, before they had interacted with the information banner at all.
- Refusal was not honoured. When a visitor clicked “Refuse all”, or later withdrew consent, new cookies were still placed and cookies already present continued to be read. This is the finding to take seriously. The interface said one thing and the technical layer did another.
- The banner did not explain purposes. Two cookie management interfaces were displayed, both incomplete. The first offered “Cookie settings”, “Reject all” and “Accept” and contained no information at all about the advertising purposes of the trackers.
A site can pass every visual test in the industry and still fail all three of those. In practice they usually fail together, and the cause is almost always the same: a consent platform installed as a front end while tag manager containers, server-side integrations and a handful of legacy scripts continue to fire on their own schedule.
The Google findings are structurally different but point the same way. Per the CNIL’s summary of that decision, users creating an account were steered toward personalised advertising cookies over generic ones and were not clearly told that placing advertising cookies was a condition of using the service. Consent obtained that way was not valid. The cookie breach alone concerned more than 74 million accounts in France.
How much enforcement there actually was
A figure of 83 sanctions totalling EUR 486.8 million for 2025 has circulated widely, and it holds up. The CNIL’s own review of its 2025 sanctions, published on 9 February 2026, records 83 sanctions, a cumulative EUR 486 839 500 in fines, and 143 formal notices. Twenty-one of the sanctions concerned trackers: placement without consent, insufficient information, and failure to honour a refusal or a withdrawal of consent.
The last of those three is the same defect the SHEIN decision turns on. It is now a repeated enforcement theme rather than a one-off.
What actually gets checked, then and now
| Layer | The 2022 test | The 2026 test |
|---|---|---|
| Buttons | Reject as easy as accept | Same, and now assumed rather than praised |
| Timing | No pre-ticked boxes | Nothing non-essential written before a choice is made |
| Information | A policy link | Purposes and third parties named in the banner itself |
| After the click | Rarely examined | Network traffic after refusal, and after withdrawal |
| Withdrawal | A link somewhere | A path as reachable as the original choice, that actually works |
The practical implication is that the audit is a network capture, not a screenshot. Load the site in a clean profile, click “Reject all”, browse three pages, and read the request log. If anything non-essential is still writing or reading, you have the SHEIN defect regardless of how good the banner looks. Our piece on measuring with less data covers what remains available once you genuinely honour refusals, which is more than most teams expect.
Why the technical layer drifts out of line with the banner
It is worth being specific about the mechanism, because “the consent tool was misconfigured” is not a diagnosis anyone can act on. Four failure modes account for most of what we find.
- Scripts that load outside the consent tool. Anything hard-coded into a template, injected by a plugin, or added by a third-party embed sits outside the tool’s control by construction. The tool cannot block what it never wrapped.
- Server-side tagging. Moving collection to a server endpoint hides it from the browser console and from most consent platforms at once. It does not remove the legal question, and it makes the drift invisible to the people who would otherwise notice it.
- Cookies already on the device. The SHEIN finding covers reading as well as writing. A tracker set on a previous visit keeps being read unless something actively clears it on refusal. Most implementations stop writing and never clear.
- Consent state that is not shared. When a widget, a video embed and an analytics library each keep their own view of what the visitor chose, the site as a whole has no single answer to give a regulator.
These are engineering problems with legal consequences, which is why the remediation belongs with whoever owns the front end rather than with whoever bought the consent licence.
The Digital Omnibus: a proposal, not a rule
In November 2025 the Commission proposed moving terminal-equipment consent out of the ePrivacy Directive and into the GDPR, through two new articles. This is the source of the widely repeated claim that cookie banners are being abolished. Two things need to be said plainly.
First, the status. These are proposals. They are in the ordinary legislative procedure and can be amended or dropped. Nothing in them is currently binding on anyone. Track the state of play on the Commission’s Digital Omnibus page rather than through summaries.
Second, the substance is narrower than the headlines. As proposed, Article 88a would create a consent exemption for audience measurement, but on strict terms: first party only, no cross-site tracking, no sharing with third parties. It would also bar re-asking for the same purpose for at least six months after a refusal, which is a real change, because a large share of current consent platform configurations re-prompt on every return visit. Article 88b would make browser-level consent signals binding on controllers within a transition window.
The law firm Osborne Clarke, writing in December 2025, is sceptical that any of this ends the banner. Their analysis of the proposal concludes that whether it will finally make it possible to browse without cookie banners is more than questionable, and expects a hybrid arrangement in which consent banners and notification banners coexist. They also expect a longer transition phase rather than a quick cure on the machine-readable signal side. That is a law firm’s view rather than a regulator’s, and it is worth weighing against the vendor commentary predicting the end of consent management.
What to do between now and whenever the omnibus lands
- Capture the network, not the screenshot. Reject all, then read what still fires. Repeat after withdrawing consent, which is the case teams almost never test.
- Inventory every script that can set storage. Tag manager containers, chat widgets, embedded video, A/B tools, session recorders, and anything a marketing contractor added.
- Name purposes and third parties in the banner. A link to a policy did not save SHEIN.
- Make withdrawal as reachable as the original choice, and verify it works. Half of the enforcement theme in 2025 sits in the withdrawal path.
- Do not redesign around Articles 88a and 88b yet. Build so the change is cheap when it arrives: one consent state, read by everything, rather than five components with their own logic.
The banner is a symptom. The underlying question is what the site collects and on what basis, which we covered in what you can actually collect on your own website, and what happens when someone asks you to prove it, which is the subject of setting up a process for data requests. The design side of the same problem, where a banner stops being persuasion and becomes manipulation, is covered in our piece on dark patterns.
If your consent layer was installed once and never verified against the network log, that is a two-hour check with a large downside if it fails, and it is the single highest-value thing on this list. It is also the sort of work we fold into a rebuild when we ship online stores, because the tracking layer is where retrofits are most expensive.
This article summarises published regulator decisions and a Commission legislative proposal as at August 2026. It is not legal advice, and the treatment of a specific tracker depends on facts about your own stack.
