€1.25B in European Privacy Fines in 36 Days: What It Means for You

Dates are when each decision was published by the EDPB or, for Fnac Darty, the CNIL; several were adopted earlier.

Total: €1,256,098,000 in 36 days, plus several smaller penalties. The two giants aren't about cookies, but the lessons scale down:

• Uber deactivated drivers automatically over suspected fraud or low ratings without explaining enough (EDPB). If your site auto-blocks accounts or orders, your privacy notice must say so.
• Google has six months to bring its location-data processing into line (EDPB). Vague notices and open-ended retention are the small-site equivalent.
• Xandr relied on Grindr's consent, which Norway's regulator found invalid (EDPB). If ad partners depend on your banner, your consent is their legal basis.
• IQVIA called its data anonymous, but a persistent ID plus details like year of birth and diagnoses could single people out (EDPB). Removing names doesn't make data anonymous if an ID still links records to one person.
• BBVA blamed a sync failure between internal systems and its marketing CRM (EDPB). Objections must reach every system that sends messages.

Regulators are also standardizing when to fine. Guidelines the EDPB adopted for public consultation on September 21, 2026 say that if an infringement is not minor, "there is a strong presumption that a fine should be imposed" (EDPB).

On October 22, 2026, the CNIL's sanctions committee fined two Fnac Darty companies €7 million in total: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct (published October 29). The case began with a complaint from the privacy group noyb, and the CNIL inspected the mobile app in March 2024 (CNIL, in French).

The app sent requests through an API to a third-party domain, carrying a Fnac-assigned user ID and activity data such as products viewed, to power and train its recommendations. Users had chosen not to be tracked, and the tracking ran anyway. The CNIL found that no consent exemption under Article 82 of the French Data Protection Act, France's version of the ePrivacy cookie rule, applied.

The companies have one month to prove they now collect consent where required, or pay €10,000 per day of delay. The decision echoes the CNIL's €150 million SHEIN fine in September 2025 for cookies placed before consent and after refusal.

What to take from it:
• Consent rules cover any tracker: SDKs, pixels and API calls, not just cookies.
• Personalization and recommendations aren't "strictly necessary" just because they're useful.
• A banner that records "No" without stopping the data flow documents a refusal you ignored.
• Test the refusal path, not just Accept; our GDPR self-audit guide shows how.

The European Commission proposed the Digital Omnibus on November 19, 2025, amending the GDPR, the ePrivacy Directive and other digital laws (European Commission). On October 21, 2026, member-state ambassadors in Coreper agreed the Council's negotiating mandate, published as document ST 14756/26 (Council text).

For a small site, the Council version would mean: anonymous, aggregated audience measurement run by you or a contractor, with no reuse, sharing or combining with other data, could skip consent. Ad pixels, retargeting and session replay would still need opt-in. Whether a mainstream analytics tool qualifies would depend on its setup and contract.

The Council text would also limit breach reports to regulators to high-risk breaches, within 96 hours instead of today's 72. Law firm Heuking's analysis compares the two versions in detail.

The European Parliament hasn't adopted its position. Its Legislative Observatory lists file 2025/0360(COD) as "Awaiting committee decision," with the industry (ITRE) and civil liberties (LIBE) committees jointly responsible (Legislative Observatory). Trilogues, the three-way talks with the Council and Commission, start only after that, and Parliament could restore the browser-signal rule.

The road ahead:
1. Parliament committee vote and plenary position (no date scheduled)
2. Trilogue negotiations
3. Formal adoption
4. Up to 24 months for EU countries to apply new cookie rules, under the Council's text

Heuking expects entry into force "not before 2027." Add the 24-month window, and today's cookie rules will realistically govern EU websites for at least another year, likely longer.

Regulators aren't waiting. In a binding decision published July 14, 2026, the EDPB told Belgium's regulator to rule on the merits of a noyb complaint about cookie banners on broadcaster VRT's website rather than dismiss it (EDPB). In the US, California already requires businesses that sell or share personal data to honor Global Privacy Control signals (our GPC guide).

The UK moved first. The main data protection changes in Part 5 of the Data (Use and Access) Act 2025 (DUAA) took effect on February 5, 2026 (DLA Piper). They include new cookie consent exceptions under PECR, the Privacy and Electronic Communications Regulations that contain the UK's cookie rule.

The ICO's final guidance, published in April 2026, sets out five exceptions to cookie consent (ICO). Two matter most for websites:

• Statistical purposes: storage or access solely to collect statistics about how your service is used, to improve it
• Appearance: adapting how your site looks or works to the visitor's preferences

Both require clear information and an easy way to object, and they cover only that purpose: statistics data can't also feed advertising. Fines rose too: PECR breaches now carry penalties of up to £17.5 million or 4% of global annual turnover, whichever is higher, up from £500,000 (Lewis Silkin; Mishcon de Reya).

With UK visitors: ads and retargeting still need consent. If you also serve EU visitors, the stricter EU rule is the safe default for a single banner.

If your site runs an AI chat widget, one EU rule is already live. Article 50 of the AI Act has applied since August 2, 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, delayed the high-risk rules to December 2, 2027 (Annex III systems) and August 2, 2028 (AI in regulated products) but left Article 50 on schedule (Cooley).

What Article 50 requires:
• Chatbots: providers must design AI systems that interact with people so users are told they're dealing with an AI, unless that's obvious.
• Timing: the notice must be clear and given at the latest at the first interaction.
• Published content: deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless the text was human-reviewed and someone holds editorial responsibility.

The chatbot duty sits with the provider: possibly you, if you built your own assistant and run it under your name; otherwise the widget vendor. Either way the disclosure appears on your site, so check that your widget says it's an AI at the start of the conversation. Transcripts are personal data too, so list the vendor in your privacy notice and sign its DPA.

1. Test the refusal path: click Reject in a private window and confirm no analytics or ad requests fire.
2. Make Reject one click on the first layer, as prominent as Accept; both reform texts would require single-click refusal.
3. Inventory every tracker, including app SDKs and API calls (Fnac Darty).
4. Update your privacy notice with recipients, automated decisions and retention periods (Uber, Google).
5. Route objections everywhere: email, SMS, push and in-app (BBVA).
6. Don't call data anonymous if a persistent ID links it to one person (IQVIA).
7. Check your ad partners' consent chain so valid signals reach them (Xandr).
8. UK visitors: add clear information and an easy objection for statistics or appearance cookies.
9. AI chat widget: confirm it discloses that it's an AI and is listed in your privacy notice.

Don't redesign your banner for the Omnibus yet; revisit when Parliament adopts its position. For US deadlines, see every privacy law change hitting websites on January 1, 2027; for consent tools, our comparison of seven GDPR and CCPA tools.