Enforcement, read closely.
What regulators and courts are doing about cookies, pixels and consent, and what each decision means for the code that runs in your visitors’ browsers. Written by the team that has to implement it.
-
-
Asercion v. Ulta: a privacy policy alone was not consent to tracking
A federal court let CIPA wiretap and pen-register claims against Ulta proceed, holding a posted privacy policy alone did not show consent to trackers. -
Australia’s privacy regulator treats tracking pixels as a consent problem, not a cookie problem
OAIC determinations against Medmate and Monash IVF, and a sweep of 50 health sites, show why blocking at the cookie layer alone misses the leak. -
Brazil’s ANPD fines TikTok R$153.7 million, starting with the feed nobody logs into
ANPD’s record LGPD fine on ByteDance treats TikTok’s logged-out feed as a processing surface that needs a legal basis, even though no account exists. -
CNIL brings email tracking pixels under the cookie rule
CNIL’s recommendation puts email open-tracking pixels under Article 82: consent for most uses, two narrow exemptions, a transition that ended 14 July 2026. -
CNIL fines EXTIA €300,000 after an audit run under the EDPB’s erasure sweep
CNIL fined EXTIA €300,000 for mishandled erasure requests. The audit ran under the EDPB’s 2025 coordinated action on the right to erasure. -
Consent Manager registration under the DPDP Rules starts on 13 November 2026
Rule 4 of the DPDP Rules, 2025 takes effect on 13 November 2026, six months before May 2027. What it requires of applicants and what it does not change. -
Dutch DPA sanctions are now public by default, and cookie banners are an enforcement target
Since 1 September 2026 the Dutch DPA must publish the GDPR sanctions it imposes under Article 21b UAVG. What that means for cookie enforcement. -
Germany didn’t fine Apple over tracking consent. It made the prompts symmetric.
The Bundeskartellamt closed its Apple ATT case with binding commitments, not a fine: Apple’s consent prompt and third-party prompts must be designed alike. -
Ireland’s DPC fines Google €403 million over location data, nearly eight years after the complaints
The DPC fined Google €403 million on 21 September 2026 over three location settings. Its findings cover lawfulness, transparency, accountability and retention. -
Korea’s amended PIPA: 10 percent fines, CEO accountability and earlier breach notice
South Korea’s amended PIPA took effect on 11 September 2026: fines up to 10 percent of revenue for aggravated cases, a named CEO duty and earlier breach notice. -
SB 690 is law: California ends private pen register suits over website trackers
Newsom signed SB 690 on 30 September 2026. Private CIPA pen register claims over websites go to the Attorney General alone. Wiretap claims remain. -
South Africa’s SABS enforcement notice: the ransomware attack was the trigger, not the violation
The Information Regulator’s notice to SABS followed a 2024 ransomware attack, but the findings rest on compliance gaps like inadequate consent and notice. -
The EU’s cookie consent rewrite has lost its browser-signal fix, for now
The Digital Omnibus would move cookie rules into the GDPR. The Council text drops the Article 88b browser signal; neither institution has a final position. -
The Google ad tech remedy is about competition, but it runs through the bidstream
Google keeps AdX but must open auctions to Prebid and rival ad servers. A competition remedy that reshapes the RTB pipes EU regulators still scrutinise. -
EDPB’s new test: when a GDPR breach gets a fine, not a reprimand
EDPB Guidelines 04/2026 set a five-step test for fines. A minor breach usually gets a reprimand; anything more carries a strong presumption of a fine. -
California’s Delete Act gets its first bite: two data-broker fines in eleven days
California’s DROP deletion platform became mandatory on 1 August 2026. By 13 August the CPPA had fined two brokers, one in a joint CCPA/Delete Act case. -
Consent before cookies: what enforcement actually means in the browser
A banner that asks is not a gate that holds. What it technically takes to stop analytics, pixels and iframes from firing before a visitor decides.