Who checks, and under which law

Who checks

• Cookies: The CNIL (Commission nationale de l'informatique et des libertés), France's data protection regulator
• Accessibility: France's consumer protection authority (DGCCRF) and the courts. Disability associations can take you to court.
• Payments: Your bank, the one that processes your card payments, under the card companies' security rules (PCI DSS)

Which rules apply

• GDPR, the EU's data protection law, and the French data protection act (its article 82 covers cookies)
• European Accessibility Act, the EU law on websites that work for people with disabilities, in French law since 28 June 2025
• The card companies' security rules, PCI DSS 4.0.1 (part of your contract with your bank, not a law)

Recent actions

• CNIL fined Google €325M and Shein €150M over cookies (Sept 2025)
• 23 fast-track CNIL fines (simplified sanctions) in the first half of 2026, about €5,800 on average
• Caen court ordered Carrefour to make its shop and app accessible within six months (June 2026)

How we work there

We may write to firms at their work email address. Fixes are done in French.

Who checks

• Cookies: The ICO (Information Commissioner's Office), the UK's data protection regulator, under PECR (the rules on cookies and marketing messages) and UK GDPR
• Accessibility: At home, customers can bring claims under the Equality Act 2010. For your sales into the EU, that country's authorities.
• Payments: Your bank, the one that processes your card payments, under the card companies' security rules (PCI DSS)

Which rules apply

• PECR (the rules on cookies and marketing messages) and UK GDPR (data protection)
• Data (Use and Access) Act 2025: fines for cookie and marketing breaches raised to the GDPR level
• Equality Act 2010; the European Accessibility Act for sales into the EU
• The card companies' security rules, PCI DSS 4.0.1

Recent actions

• The maximum fine for cookie and marketing breaches (PECR) raised from £500,000 to £17.5M or 4% of turnover
• ICO wrote to the top 1,000 websites about cookie compliance
• ICO finalised its guidance on cookies and tracking technologies (2026)

How we work there

Fixes in English. We check the EU accessibility law only if you sell into the EU.

Who checks

• Cookies: The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority
• Accessibility: The ACM (Autoriteit Consument & Markt), the Dutch consumer and markets authority, for webshops
• Payments: Your bank, the one that processes your card payments, under the card companies' security rules (PCI DSS)

Which rules apply

• Telecommunicatiewet (the Dutch cookie rules) and GDPR (AVG in Dutch)
• European Accessibility Act, in Dutch law since 28 June 2025
• The card companies' security rules, PCI DSS 4.0.1

Recent actions

• AP scans about 10,000 Dutch websites a year for cookies
• ACM found 61% of the largest Dutch webshops not accessible to customers with disabilities (March 2026)
• Coolblue fined €40,000 for cookies (Dec 2024)

How we work there

Fixes in Dutch. We contact Dutch firms by LinkedIn, letter or phone, never by unsolicited email.

Who checks

• Cookies: Your national data protection authority
• Accessibility: Your country's market surveillance authority, which checks products and services on sale (in Germany, under its accessibility law, the BFSG)
• Payments: Your bank, the one that processes your card payments, under the card companies' security rules (PCI DSS)

Which rules apply

• The EU's cookie rules (ePrivacy) and GDPR, applied by each country
• European Accessibility Act, in each country's law since 28 June 2025 (Germany: BFSG)
• The card companies' security rules, PCI DSS 4.0.1

Recent actions

• EU member states agreed their position on the Digital Omnibus, a planned simplification of EU digital rules, in October 2026: the cookie consent rules stay for now
• EN 301 549 V4.1.1, the European accessibility standard, published in September 2026: it moves to version 2.2 of the international accessibility checklist (WCAG)
• Germany: fines up to €100,000 under its accessibility law (BFSG), plus warning letters from competitors

How we work there

Fixes in English, French or Dutch; other languages on request; local rules checked before we contact anyone.