09 · Sources
Where every figure comes from
Checked on 8 November 2026. Secondary sources are named as such.
- CNIL, Sanctions and corrective measures 2025 (9 Feb 2026)
- CNIL, Cookies and tracking devices (sanctions list) (2025 to 2026)
- CNIL, Sanctions tag page (American Express) (Dec 2025)
- CNIL, La procédure de sanction simplifiée (checked Nov 2026)
- Journal de l'économie, 23 sanctions simplifiées depuis janvier 2026 (7 Jul 2026)
- Hogan Lovells, Overview of the CNIL's deliberations in 2025 (18 May 2026)
- PinMeTo, EAA enforcement reaches French courts (secondary) (2026)
- Kolonell, EAA fines and remediation budget for SMEs (secondary) (15 Oct 2026)
- Swetrix, How to comply with PECR cookie rules (secondary) (2026)
- Stevens and Bolton, ICO guidance after the Data (Use and Access) Act (6 May 2026)
- ACM, Majority of large online stores not accessible (24 Mar 2026)
- Jorijn, European Accessibility Act: is your website compliant? (secondary, ACM fine ceiling) (2026)
- Clickport, Privacy analytics in the Netherlands (AP scans, secondary) (2026)
- NOS, Toezichthouder pakt websites aan die illegaal cookies plaatsen (2025)
- Privacy-web, Fine for Coolblue for unsolicited use of cookies (23 Dec 2024)
- Dutch IT Channel, AP legt Kruidvat boete van 600.000 euro op (16 Jul 2024)
- CNIL, transfer of data to a social network for advertising purposes: €3.5 million fine (22 Jan 2026)
- CNIL, cookies and mobile application: €7 million fine against Fnac Darty and Fnac Direct (29 Oct 2026)
- PPC Land, Dutch regulator reduces AS Watson fine to €50,000 (2025)
- Händlerbund, Was droht, wenn Barrierefreiheitsanforderungen nicht umgesetzt werden (BFSG fines) (checked Nov 2026)
- DmarcDkim.com, DMARC adoption in France, September 2026 (Sep 2026)
- DMARC Report, Microsoft Outlook DMARC requirements (2025)
- McDonald Hopkins, The FBI's 2025 IC3 report (secondary) (7 Apr 2026)
- AbilityNet, Click-Away Pound 2019 results (11 Feb 2020)
- Sansec, CosmicSting attack and defense overview (security research firm; fix 11 June 2024, 2,000+ stores hacked on 14 October 2024) (2024)
- Deepstrike, PCI DSS 6.4.3 and 11.6.1 (4 Nov 2026)
- PCI Security Standards Council, Merchants (validation and reporting go to the acquirer or payment brand) (checked 8 Nov 2026)
- Davis Wright Tremaine, EN 301 549 V4.1.1 published (Sep 2026)
- PPC Land, Council mandate on the Digital Omnibus (Oct 2026)
- Kolonell, WCAG compliance cost (automated tools find 30 to 40% of criteria) (2026)
- EUR-Lex, Directive (EU) 2019/882, the European Accessibility Act (Art. 2, 3, 4(5), 32 and Annex V) (17 Apr 2019)
- ACM, Accessibility of e-commerce services and electronic communications services (checked 8 Nov 2026)
- Equality Act 2010, section 29 (provision of services), legislation.gov.uk (checked 8 Nov 2026)
- PCI Security Standards Council, FAQ: does PCI DSS apply to merchants who outsource all payment processing? (checked 8 Nov 2026)
- US Federal Trade Commission, order requires online marketer to pay $1 million for deceptive claims its AI product could make websites compliant (3 Jan 2025)
- Sansec, Polyfill supply chain attack hits 100K+ sites (security research firm) (25 Jun 2024)
- Sansec, Cardbleed: 3% of Magento install base hacked (security research firm) (14 Sep 2020, updated 18 Sep 2020)
- Court of Justice of the EU, press release 99/19, judgment in case C-40/17 Fashion ID (29 Jul 2019)
- Hunton Andrews Kurth, ICO fines Ticketmaster £1.25 million for security failures (secondary, law firm summary of the ICO notice) (16 Nov 2020)
- Tribunal judiciaire de Caen, ordonnance de référé, apiDV and Droit Pluriel v Carrefour France (full text on Doctrine) (4 Jun 2026)
- WebAIM, The WebAIM Million 2026 (data February 2026) (updated 30 Mar 2026)
- Autoriteit Persoonsgegevens, Boete van 600.000 euro voor tracking cookies op Kruidvat.nl (16 Jul 2024)
- Conseil d'État, decision no. 433311 of 4 November 2020 (SERGIC v CNIL) (4 Nov 2020)
- CNIL, Délibération SAN-2019-005 du 28 mai 2019 (Légifrance) (28 May 2019)
- CNIL, Délibération SAN-2024-002 du 31 janvier 2024 (Légifrance) (31 Jan 2024)
- CNIL, Délibération SAN-2024-021 du 19 décembre 2024 (Légifrance) (19 Dec 2024)
- CNIL, Délibération SAN-2018-007 du 24 juillet 2018 (Légifrance) (24 Jul 2018)
- CNIL, Les sanctions prononcées par la CNIL (checked 8 Nov 2026)
- CNIL, Location d'un bien immobilier : quels justificatifs peut-on demander aux candidats ? (10 Oct 2025)
- CNIL, Pièces justificatives à fournir pour l'accès à la location : un cadre juridique pris en compte par les professionnels (9 Jul 2019)
- CNIL, Référentiel relatif aux traitements de données mis en œuvre dans le cadre de la gestion locative (6 May 2021)
- Loi n° 65-557 du 10 juillet 1965, article 18, Légifrance (checked 8 Nov 2026)
- Money Laundering Regulations 2017, regulation 13, legislation.gov.uk (checked 8 Nov 2026)
- Money Laundering Regulations 2017, regulation 40, legislation.gov.uk (checked 8 Nov 2026)
- Immigration (Residential Accommodation) (Prescribed Requirements and Codes of Practice) Order 2014, article 5, legislation.gov.uk (checked 8 Nov 2026)
- Client Money Protection Schemes for Property Agents Regulations 2019, regulation 3, legislation.gov.uk (checked 8 Nov 2026)
- Client Money Protection Schemes for Property Agents Regulations 2019, regulation 4 (certificate on the website), legislation.gov.uk (checked 8 Nov 2026)
- Housing Act 2004, section 213, legislation.gov.uk (checked 8 Nov 2026)
- Wired-Gov, Estate agency fined £80,000 for failing to keep tenants' data safe (ICO release, republished) (secondary) (19 Jul 2019)
- Public Technology, Social housing provider reprimanded after data breach of antisocial behaviour case files (secondary) (25 Apr 2024)
- NOS, Huurmakelaars vragen potentiële huurders om steeds meer inkomensgegevens (secondary) (28 Jul 2025)
- Tweede Kamer, Aanhangsel van de Handelingen 2023-2024, no. 947 (answers by the Minister for BZK) (6 Feb 2024)
- Wwft, Wet ter voorkoming van witwassen en financieren van terrorisme, wetten.overheid.nl (checked 8 Nov 2026)
- Hoge Raad, 28 May 2021, ECLI:NL:HR:2021:783 (general commercial case, not property) (28 May 2021)
- IMY (Swedish data protection authority), decision on Apoteket AB, IMY-2022-3270 (29 Aug 2024)
- IMY (Swedish data protection authority), decision on Apohem AB, IMY-2022-3272 (29 Aug 2024)
- Court of Justice of the EU, judgment in case C-252/21, Meta Platforms and Others v Bundeskartellamt (paragraphs 68 to 73) (4 Jul 2023)
- Court of Justice of the EU, judgment in case C-21/23, Lindenapotheke (4 Oct 2024)
- CNIL, Les sanctions prononcées par la CNIL (list of sanctions) (checked 8 Nov 2026)
- CNIL, Violation de données en matière de santé : sanction de 500 000 euros à l'encontre de l'Hôpital privé de la Loire (3 Sep 2026)
- CNIL and CNOM, Guide pratique sur la protection des données personnelles (fiches 1 to 3) (Jun 2018)
- Le Monde du Droit, two doctors fined by the CNIL (secondary) (7 Jan 2021)
- MACSF, doctors' communication of information to the public (secondary) (20 Feb 2026)
- Légifrance, Code de la santé publique, article L1110-4 (version in force since 4 Aug 2021)
- Légifrance, Code pénal, article 226-13 (checked 8 Nov 2026)
- NCSC, Email security and anti-spoofing (7 Oct 2019)
- NHS, Data Security and Protection Toolkit (checked 8 Nov 2026)
- GOV.UK, Accessibility requirements for public sector websites and apps (updated 30 Sep 2024)
- General Dental Council, Guidance on advertising (effective 30 Sep 2013)
- The Pharmaceutical Journal, pharmacy incurs first UK data protection fine (secondary) (20 Dec 2019)
- Tech Monitor, ICO fines Advanced £3.07m after NHS data breach (secondary) (27 Mar 2025)
- PA via BreakingNews.ie, NHS trusts passed on private patient information to Facebook (secondary) (28 May 2023)
- NOS, AP fine of €440,000 on OLVG (secondary) (11 Feb 2021)
- Tweede Kamer, Kamerstuk 32761 nr. 334, letter from the State Secretary for Health (5 Feb 2026)
- Officiële bekendmakingen, Besluit elektronische gegevensverwerking door zorgaanbieders, Stb. 2017, 446 (2017)
- Officiële bekendmakingen, Stcrt. 2026, 17743 (NEN 7510 editions from 1 June 2026) (18 May 2026)
- wetten.overheid.nl, Wet gelijke behandeling op grond van handicap of chronische ziekte (Wgbh/cz) (version from 1 Jan 2026)
- internet.nl, website and email test (an initiative of the internet community and the Dutch government) (checked 8 Nov 2026)
- EUR-Lex, Directive 2011/83/EU on consumer rights, article 3(3)(b) (checked 8 Nov 2026)
- Journal du Net, column on Tribunal judiciaire de Paris, 25 March 2026, RG 23/11725 (secondary) (22 Sep 2026)
- Journal de l'économie, relaying Le Monde and ANSSI on hacked notarial offices (secondary) (4 Sep 2026)
- SRA, How to reduce the risk of being affected by cybercrime (23 Nov 2020)
- SRA, Risk Outlook 2020/21, Information and cyber security (2020)
- SRA, Code of Conduct for Firms (checked 8 Nov 2026)
- SRA, Code of Conduct for Solicitors (checked 8 Nov 2026)
- SRA, Accounts Rules (checked 8 Nov 2026)
- SRA, Scam alerts (checked 8 Nov 2026)
- NCSC, Cyber Threat Report: UK Legal Sector (22 Jun 2023)
- Autoriteit Persoonsgegevens, Rapportage datalekken 2025 (8 Jul 2026)
- Notaires de France, Fraude au virement ou au RIB : les Notaires de France appellent à la vigilance (6 Sep 2024)
- CNB, Guide pratique La sécurité numérique du cabinet d'avocat (1) (Oct 2023)
- CNB, Règlement intérieur national de la profession d'avocat (RIN), consolidated (updated 5 Nov 2026)
- Ordre des experts-comptables, cyber commandements (2017, revised 2019)
- CNIL, Recommandation sur les pixels de suivi dans les courriels (14 Apr 2026)
- CNIL, Les sanctions prononcées par la CNIL (updated 14 Apr 2026)
- CERT-FR (ANSSI), État de la menace informatique contre les cabinets d'avocats (27 Jun 2023)
- DGCCRF, Fiche information consommateurs on the accessibility directive (handicap.gouv.fr) (Jul 2025)
- Cour de cassation, chambre commerciale, 17 juin 2026, n° 24-13.306 (Légifrance) (17 Jun 2026)
- Cour de cassation, chambre commerciale, 1er juillet 2026, n° 25-15.283 (Légifrance) (1 Jul 2026)
- Equality Act 2010, section 20 (duty to make adjustments), legislation.gov.uk (checked 8 Nov 2026)
- Equality Act 2010, schedule 2 (services: reasonable adjustments), legislation.gov.uk (checked 8 Nov 2026)
- Data (Use and Access) Act 2025, schedule 12, legislation.gov.uk (checked 8 Nov 2026)
- Data (Use and Access) Act 2025, schedule 13, legislation.gov.uk (in force 5 Feb 2026)
- Payment Systems Regulator, APP fraud reimbursement protections (rules from 7 Oct 2024)
- UK Supreme Court, [2023] UKSC 25 (Find Case Law) (12 Jul 2023)
- Court of Appeal, [2018] EWCA Civ 1082 (Find Case Law) (15 May 2018)
- Legal Futures, criminal law firm fined £98,000 for cyber security negligence (secondary) (10 Mar 2022)
- Legal Futures, ICO reprimands law firm over data breach that saw money stolen (secondary) (15 Aug 2023)
- The Register, report on the ICO's £60,000 penalty on DPP Law (secondary) (16 Apr 2025)
- Legal Futures, law firm rebuked for paying client money to fraudster (secondary) (16 Mar 2017)
- Legal Futures, hacked law firm and barristers named in second wave of LeO decisions (secondary) (30 Sep 2025)
- Hoge Raad, ECLI:NL:HR:2021:783 (Rechtspraak) (28 May 2021)
- Rechtbank Midden-Nederland, ECLI:NL:RBMNE:2021:1528 (Rechtspraak) (14 Apr 2021)
- Gerechtshof 's-Hertogenbosch, ECLI:NL:GHSHE:2017:4625 (Rechtspraak) (24 Oct 2017)
- Gerechtshof 's-Hertogenbosch, ECLI:NL:GHSHE:2018:4531 (Rechtspraak) (30 Oct 2018)
- Kamer voor het notariaat Den Haag, ECLI:NL:TNORDHA:2023:14 (overheid.nl) (23 Aug 2023)
- KNB, Reglement beperking uitbetaling derdengelden gewijzigd (5 Aug 2026)
- KNB, Verzekering fraude en geldswaarden (undated, checked Nov 2026)
- KNB, Notariaat Magazine nr. 4, Gehackt (Jun 2021)
- NOvA, Toelichting bij gedragsregel 3 (vertrouwelijkheid) wijzigt 1 januari 2025 (19 Dec 2024)
- KBvG, Dossier E-mail & sms-oplichting (May 2019)
- Wet gelijke behandeling op grond van handicap of chronische ziekte (Wgbh/cz), wetten.overheid.nl (version from 1 Jan 2026)
- EUR-Lex, Regulation (EU) 2024/886 (instant payments and Verification of Payee, article 5c) (19 Mar 2024)
- Court of Justice of the EU, judgment in case C-245/18 (EUR-Lex) (21 Mar 2019)
- Loi n° 2023-451 du 9 juin 2023, article 7 (agents d'influenceurs), Légifrance (checked 8 Nov 2026)
- Loi n° 2023-451 du 9 juin 2023, article 8 (contrat écrit, responsabilité solidaire), Légifrance (checked 8 Nov 2026)
- Ordonnance n° 2024-978 du 6 novembre 2024, text notified to the European Commission (TRIS 2024/0379/FR) (checked 8 Nov 2026)
- Décret n° 2025-1137 du 28 novembre 2025, Légifrance (checked 8 Nov 2026)
- Ministère de l'Économie, Guide de bonne conduite: influence commerciale (Jun 2026, checked 8 Nov 2026)
- Loi n° 2020-1266 du 19 octobre 2020 (image des enfants de moins de seize ans en ligne), Légifrance (checked 8 Nov 2026)
- DGCCRF, Bilan des contrôles 2022 et 2023 dans le secteur de l'influence commerciale (3 Apr 2024, checked 8 Nov 2026)
- DGCCRF, Bilan d'activité 2024 (pages 11, 23 and 37) (2025, checked 8 Nov 2026)
- DGCCRF, Rapport d'activité 2025 (pages 19, 24 and 25) (2026, checked 8 Nov 2026)
- ANJ, Communication n° 2022-C-002 (recommandations sur les communications commerciales) (17 Feb 2022, checked 8 Nov 2026)
- CNIL, Les sanctions prononcées par la CNIL (checked 8 Nov 2026)
- CNIL, La prospection commerciale par courrier électronique, SMS-MMS et automate d'appel (10 Jun 2026, checked 8 Nov 2026)
- Code du sport, sport professionnel (article L. 222-2-10-1), Légifrance (version in force since 5 Aug 2026, checked 8 Nov 2026)
- CAP Code, section 1: compliance (rule 1.8), ASA (checked 8 Nov 2026)
- ASA and CMA joint guide, Influencers' guide to making clear that ads are ads (4th edition) (Oct 2026, checked 8 Nov 2026)
- ASA, Influencer ad disclosure on social media: Instagram and TikTok (report) (May 2025, checked 8 Nov 2026)
- CMA, Who regulates hidden advertising? (checked 8 Nov 2026)
- CMA, Social media endorsements: guidance for content creators (updated 3 Sep 2025, checked 8 Nov 2026)
- CMA, Social media endorsements: guidance for brands (updated 28 Aug 2025, checked 8 Nov 2026)
- CMA, CMA acts to prevent misleading online practices (Social Chain undertakings) (11 Aug 2016, checked 8 Nov 2026)
- DMCC Act 2024, section 182 (penalties), legislation.gov.uk (in force 6 Apr 2025, checked 8 Nov 2026)
- DMCC Act 2024, schedule 20 (practices unfair in all circumstances), legislation.gov.uk (checked 8 Nov 2026)
- GOV.UK, Set up as a sole trader (checked 8 Nov 2026)
- Consumer Protection Act 1987, section 2, legislation.gov.uk (checked 8 Nov 2026)
- Employers' Liability (Compulsory Insurance) Act 1969, section 1, legislation.gov.uk (checked 8 Nov 2026)
- Privacy and Electronic Communications Regulations 2003, regulation 22, legislation.gov.uk (checked 8 Nov 2026)
- CAP Code, section 8: promotional marketing, ASA (checked 8 Nov 2026)
- CAP Code, section 16: gambling, ASA (checked 8 Nov 2026)
- CAP guidance, Gambling and lotteries advertising: protecting under-18s (Oct 2025, checked 8 Nov 2026)
- ASA, Ruling on Betway Ltd (Sir Lewis Hamilton) (3 Dec 2025, checked 8 Nov 2026)
- ASA, Ruling on Dribble Media Ltd t/a Midnite (Trent Alexander-Arnold) (17 Sep 2025, checked 8 Nov 2026)
- CAP Code, section 18: alcohol, ASA (checked 8 Nov 2026)
- CAP Code, section 15: food, food supplements and related claims, ASA (checked 8 Nov 2026)
- FCA, FG24/1 Finalised guidance on financial promotions on social media (26 Mar 2024, checked 8 Nov 2026)
- Commissariaat voor de Media, Beleidsregel kwalificatie commerciële mediadiensten op aanvraag 2025 (in force 16 Jun 2025, checked 8 Nov 2026)
- Commissariaat voor de Media, De belangrijkste regels voor video-uploaders (checked 8 Nov 2026)
- Mediawet 2008 (articles 3.5b and 7.12), wetten.overheid.nl (version in force from 1 Jan 2026, checked 8 Nov 2026)
- Commissariaat voor de Media, Sanctiebeschikking RK Content Creation (reclameregels) (18 Jun 2024, checked 8 Nov 2026)
- Stichting Reclame Code, Reclamecode Social Media & Influencer Marketing (RSM) (last amended 1 Jul 2026, checked 8 Nov 2026)
- Stichting Reclame Code, Jaarverslag 2025 (2026, checked 8 Nov 2026)
- Stichting Reclame Code, Reclamecode voor Alcoholhoudende Dranken (on the code page) (last amended 1 Apr 2024, checked 8 Nov 2026)
- ACM, Leidraad Bescherming online consument (chapter 6, influencers) (May 2024, checked 8 Nov 2026)
- Burgerlijk Wetboek Boek 6 (articles 187 and 193a), wetten.overheid.nl (version in force from 16 Jul 2026, checked 8 Nov 2026)
- KvK, Moet je je bedrijf inschrijven bij KVK? (updated 30 Oct 2026, checked 8 Nov 2026)
- Belastingdienst, Ik maak content op internet: moet ik mijn inkomsten aangeven? (modified 5 Aug 2026, checked 8 Nov 2026)
- KvK, 10 belangrijke verzekeringen voor starters (updated 27 Jan 2026, checked 8 Nov 2026)
- Uitvoeringswet AVG, article 5, wetten.overheid.nl (version in force from 1 Sep 2026, checked 8 Nov 2026)
- Telecommunicatiewet, article 11.7, wetten.overheid.nl (version in force from 15 Aug 2026, checked 8 Nov 2026)
- Nederlandse Arbeidsinspectie, Kidfluencers (modified 16 Sep 2026, checked 8 Nov 2026)
- Kansspelautoriteit, Verbod op gebruik rolmodellen in gokreclames (30 Jun 2022, checked 8 Nov 2026)
- Kansspelautoriteit, Ksa wijst op verbod rolmodellen in gokreclames (16 Jun 2022, checked 8 Nov 2026)
- Kansspelautoriteit, Last onder dwangsom voor overtreden rolmodellenverbod (Jack's Racing Day) (12 Jul 2024, checked 8 Nov 2026)
- Kansspelautoriteit, Boete van 675.000 euro voor maken reclame onvergunde online kansspelen (23 Mar 2023, checked 8 Nov 2026)
- Auteurswet, articles 20 and 21 (portretrecht), wetten.overheid.nl (version in force from 1 Jan 2026, checked 8 Nov 2026)
- European Commission, Press release IP/24/708 on the influencer sweep (14 Feb 2024, checked 8 Nov 2026)
- European Commission, Guidance on the Unfair Commercial Practices Directive (2021/C 526/01) (29 Dec 2021, checked 8 Nov 2026)
- European Commission, Press release IP/25/831 on Star Stable (21 Mar 2025, checked 8 Nov 2026)