What non-compliance has actually cost
Real decisions, with the regulator, the date and the source. Fines are not automatic and we never predict one for you. But the ceilings are high, the checks are automated, and most cases start with a single complaint.
What smaller firms actually see
Email in your name
The cost comes from fraud and lost mail, not from a regulator.
Tracking before consent
The simplified procedure, a fast track for smaller cases: up to €20,000 for organisations under €50M turnover (CNIL, checked Nov 2026). 23 such fines in early 2026 averaged about €5,800, none at the maximum (Journal de l'économie, 7 Jul 2026).
Customers with disabilities
Courts can order fixes within six months, with a sum to pay for each day late, as for Carrefour in June 2026 (PinMeTo, 2026).
Payment and site security
The bigger costs are an investigation, telling your customers, and lost trust.
The costs nobody fines you for
reported lost to fake invoices and payment requests by email in the US in 2025, mostly sent from faked addresses or ones a letter off the real one.
McDonald Hopkins, 7 Apr 2026of disabled online shoppers leave a website they find hard to use. UK retailers were estimated to lose £17.1bn a year this way.
AbilityNet, 11 Feb 2020largest email providers (Gmail, Yahoo, Outlook) now turn away or send to spam bulk mail from domains without the right email settings (SPF, DKIM and DMARC).
DMARC Report, 2025online stores hacked in a few hours on 14 October 2024, four months after the fix for the flaw was published.
Sansec, 2024Real sanctions and court orders
| Date | Who decided | Against | Outcome | Why | Source |
|---|---|---|---|---|---|
| Sep 2025 | CNIL | Google LLC and Google Ireland | €325,000,000 | Cookies: consent for advertising trackers not valid | CNIL |
| Sep 2025 | CNIL | Shein (Infinite Styles Services) | €150,000,000 | Cookies placed without consent | CNIL |
| Dec 2025 | CNIL | American Express | €1,500,000 | Cookies | CNIL |
| Nov 2025 | CNIL | Publisher of vanityfair.fr | €750,000 | Cookies placed without consent | CNIL |
| Jan to Jul 2026 | CNIL (simplified procedure) | 23 smaller organisations | €133,750 in total, about €5,800 each | Video surveillance, cookies, requests from people to see their own data ignored | Journal de l'économie |
| Jun 2026 | Caen court | Carrefour France | Order to be fully accessible within six months, with a sum to pay for each day late | Online shop and app not accessible to customers with disabilities (European Accessibility Act) | PinMeTo |
| May 2026 | Lille court | Auchan | Claim rejected on a point of procedure; appeal pending | Court noted the site did not meet accessibility standards | PinMeTo |
| Dec 2025 | CNIL | A retailer (kept anonymous by the CNIL) | €3.5 million | Loyalty members' data sent to a social network for ad targeting without valid consent | CNIL |
| Oct 2026 | CNIL | Fnac Darty and Fnac Direct | €7 million | Cookies and trackers, including in the mobile app | CNIL |
| May 2019 | CNIL | SERGIC, a property management company (named in the Conseil d'État ruling of Nov 2020) | €400,000 and publication | Candidate tenants' files (ID cards, tax notices, bank details, divorce judgments) opened by changing a number in a web address, with no login; flaw known from March 2018, fixed in September 2018; rejected candidates' files never purged | CNIL |
| Nov 2020 | Conseil d'État | SERGIC | Appeal rejected, €400,000 fine upheld | The flaw could have been avoided by simple measures such as a login; keeping every candidate's file in the live database was excessive | Conseil d'État |
| Jan 2024 | CNIL | Publisher of a property listings website for private sellers (kept anonymous in the CNIL's record) | €100,000 | Passwords could be one character long and were stored in clear text, for about 5 million accounts; data kept beyond stated periods; incomplete contract with its data processor (the provider handling data on its behalf) and privacy notice | CNIL |
| Dec 2024 | CNIL | A small estate agency (kept anonymous by the CNIL) | €40,000 | Staff monitored by cameras recording sound and by screenshot software; one administrator account and password shared by four people; no impact assessment (the written risk study the law requires for high-risk uses of personal data) | CNIL |
| Jun 2024 | CNIL (simplified procedure) | A company specialised in property management (kept anonymous by the CNIL) | €12,000 | Cookie consent, and what visitors were told | CNIL |
| Dec 2025 | CNIL (simplified procedure) | A software company serving rental and co-ownership management (kept anonymous by the CNIL) | €15,000 and order to comply | No valid legal ground for its marketing, what people were told, data security | CNIL |
| Dec 2025 | CNIL (simplified procedure) | A public body managing rental housing (kept anonymous by the CNIL) | €20,000 and order to comply | Data used beyond its stated purpose, more data than needed, what people were told, their right to object, data security | CNIL |
| Jul 2018 | CNIL | A social housing company (kept anonymous by the CNIL) | €30,000 | Tenant file used to send every tenant a letter campaigning against a housing benefit cut, a purpose incompatible with housing management | CNIL |
| Apr 2017 | CNIL | A real estate agency (kept anonymous by the CNIL) | Monetary penalty, not made public | Data kept too long, what people were told, security, and failure to answer the CNIL, concerning tenants and landlords | CNIL |
| Jul 2019 | CNIL (inspection programme) | About ten estate agencies, networked and independent (not named) | Reminders of obligations and corrective measures | On-site checks in 2018; recurring failings in what candidates and guarantors were told, how long data was kept, and physical and IT security | CNIL |
| Dec 2020 | CNIL | Two doctors in private practice (not named) | €3,000 and €6,000 | Thousands of medical images on their own servers open on the internet, unencrypted; the breach was not notified | Le Monde du Droit |
| Apr 2022 | CNIL | A laboratory software publisher (not named) | €1,500,000 | Its duties as a data processor, handling data on the laboratories' behalf, acting beyond their instructions, and security of the patient data it held | CNIL |
| May 2023 | CNIL | A health and well-being website (not named) | €380,000 | Cookies placed without consent, consent for health data from online tests, and security | CNIL |
| Jan 2024 | CNIL (simplified procedure) | A dental surgeon (not named) | €5,000 | Data security, and a patient's right of access to health data not respected | CNIL |
| Sep 2024 | CNIL (simplified procedure) | A training body for health professionals (not named) | €15,000 and an order to comply | Cookie information and consent, the right to have data deleted, no proper contract with its data processor, and security | CNIL |
| Feb 2023 to Feb 2026 | CNIL (simplified procedure) | At least nine GPs, other doctors and dental surgeons (not named) | €3,000 to €5,000 each, often with an order to comply | Mostly patients refused access to their medical file, and practitioners not answering the CNIL | CNIL |
| Jul 2026 | CNIL | Hôpital Privé de la Loire | €500,000 and an order to finish its security measures | An attacker entered through the login used by outside users, including doctors in private practice, with no VPN (a secure private connection) or two-step login (a code as well as the password); 524,867 patients affected | CNIL |
| Jun 2026 | Cour de cassation, commercial chamber (n° 24-13.306, published) | A company that paid a spoofed invoice (not named here) | Appeal ruling overturned; case sent back to the Lyon court of appeal | An invoice for €103,375.64 came from an address one letter off the supplier's. An impersonator is not an apparent creditor (someone the payer could reasonably take for the real one), so paying the invoice did not settle the debt | Cour de cassation |
| Jul 2026 | Cour de cassation, commercial chamber (n° 25-15.283) | Two bank customers (not named), in a claim against BNP Paribas | Order for the bank to repay overturned; case sent back to the Lyon court of appeal | A builder's instalment was paid to the account number (IBAN) in an email from a fake address; the bank had made the transfers to the account number given (article L.133-21, Code monétaire et financier) | Cour de cassation |
| Mar 2026 | Tribunal judiciaire de Paris (first instance, known from a press column) | A notarial office (not named in the reports) | 70% of the €68,607.38 loss on the office, 30% on the buyer; both banks cleared | The office had emailed its bank details (RIB) "par un moyen non sécurisé" (by an insecure means), against the notaries' own 2022 warning; the email was intercepted and the account number changed. Appeal status unknown | Journal du Net |
| Nov 2025 | CNIL (simplified procedure) | A law firm (anonymised by the CNIL) | €5,000 | A request to delete personal data not respected; failure to cooperate with the CNIL | CNIL |
| Oct 2021 | CNIL | A notary (anonymised by the CNIL) | €3,000 and an order to comply | Failure to cooperate with the CNIL | CNIL |
The detail, for those who want it
Fine Explorer
Pick an exposure. The market follows your choice at the top.
Legal ceiling in France
Large cases: €325M (Google) and €150M (Shein) in September 2025 (CNIL, 2025 to 2026).
What smaller firms actually see
The simplified procedure, a fast track for smaller cases: up to €20,000 for organisations under €50M turnover (CNIL, checked Nov 2026). 23 such fines in early 2026 averaged about €5,800, none at the maximum (Journal de l'économie, 7 Jul 2026).
Recorded cases
American Express €1.5M (Dec 2025), Vanity Fair publisher €750,000 (Nov 2025).
Who acts
The CNIL (Commission nationale de l'informatique et des libertés), France's data protection regulator
Bars are to scale with each other. Legal ceilings run far higher and are listed on the left. A fine is never certain; the fix is.
Cookie Fix: we set up your cookie banner with Refuse as easy as Accept, connect your advertising and statistics tools to it so nothing starts before a yes, prove it with a new scan, and give you a cookie policy and the evidence.