Cookies and consent banners: rules, fines and tracking

What cookies are and how they work

A cookie is a short piece of text a website stores in your browser so it can recognise that browser next time. That is how a shop remembers your basket and a site keeps you logged in. The trouble starts with third-party cookies: they are set by another domain embedded in the page, as an ad, a widget or an analytics tag, so the same identifier returns to it from many sites. That is how classic online tracking worked.

Cookies are only one technique now. A tracking pixel is an invisible image, usually in a web page or an email, and merely downloading it tells a server who is looking at what. A fresh example from September: OpenAI collects activity from advertisers’ sites and ties it to ChatGPT accounts through a cookie called __obi, valid for a year. Code installed by advertisers sends the identifier together with the page being viewed, including products searched for. Researchers found 936 advertiser pixels across 1,029 hostnames, and one __obi value reached OpenAI from 12 commercial sites including Chewy, Wayfair and HelloFresh. OpenAI classified __obi as an analytics cookie and did not answer questions about that.

To me that is a stretch: an identifier tied to an account, which records what you do on other sites, is hard to call analytics.

Do websites need consent for cookies

Yes, unless the cookie is strictly necessary for a service the user asked for. The rule is Article 5(3) of the ePrivacy Directive 2002/58/EC, as amended in 2009: storing information on a user’s device, or gaining access to what is already stored there, needs the user’s consent after clear and comprehensive information. The exceptions are transmitting a communication and a service the user explicitly requested (directive text on EUR-Lex, as of 16 October 2026).

The rule is not just about cookies. The European Data Protection Board’s Guidelines 2/2023, version 2.0 adopted on 7 October 2024, apply Article 5(3) to pixel and link tracking, IP-only tracking, intermittent IoT reporting and unique identifiers.

The law works on two layers. Storing and reading on the device falls under national laws implementing ePrivacy; what happens to the data afterwards falls under the GDPR. According to the EDPB cookie banner taskforce report of 17 January 2023, missing valid consent for the storage means the later processing cannot comply with the GDPR. Legitimate interest is not a basis for placing a cookie. Consent follows the GDPR standard: freely given, specific, informed and unambiguous, by a clear affirmative action (Article 4(11)), and withdrawing it must be as easy as giving it (Article 7(3)). Fines reach EUR 20 million or 4 percent of worldwide annual turnover (Article 83(5), GDPR text on EUR-Lex). See also GDPR and GDPR fines.

What Polish law says about cookies

Poland regulates cookies in Article 399 of the Act of 12 July 2024 - Electronic Communications Law (Journal of Laws 2024 item 1221, in force since 10 November 2024). Storing or accessing information on the device is allowed if the user was first clearly told the purpose and that conditions can be set in software settings, then gives consent, and the storage does not change the device configuration (paragraph 1). Consent may be given through software or service settings (paragraph 2). No consent is needed where storage is necessary to transmit a message or to provide a service the user requested (paragraph 3).

Article 400 sends consent to the personal data protection rules, so in practice the GDPR standard applies. For skipping the consent required by Article 399 the UKE President (the telecom regulator) can fine up to 3 percent of the previous year’s revenue (Article 444, paragraph 2, point 8 and Article 446, paragraph 1). The UODO President supervises processing of the data collected through cookies, under the GDPR. So UKE handles the storing and reading, UODO the later processing. Two offices, one cookie.

What a compliant cookie banner looks like

A banner must let people refuse as easily as accept. Regulators agree on that, although none dictates a design. The EDPB taskforce report is a minimum threshold agreed by authorities, not a green light for any banner. It lists as failing:

• No reject button on the layer with the accept button. The vast majority of authorities called it an infringement; a few pointed out that Article 5(3) does not mention a reject option.
• Pre-ticked boxes. GDPR recital 32: silence, pre-ticked boxes or inactivity are not consent.
• Refusal hidden in a text link, or in text unreadable to virtually any user. A banner must not suggest that you need consent to read the site.
• Legitimate interest as the basis for cookies. Shown in deeper layers, it also confuses people into thinking they must refuse twice.

Withdrawing consent must be easy to reach, for example through a permanent icon or link.

Practice in Poland falls short of these rules. In September 2026 I measured 50 big websites: on six Polish news sites “I do not consent” leaves the list of companies on legitimate interest untouched, 810 on Onet. Reaching the consent settings on tvn24.pl takes about 31 screens of scrolling. The numbers and the method are in the report on what “I do not consent” really switches off.

France’s CNIL, in its recommendation of 17 September 2020, wants ‘accept all’ and ‘reject all’ at the same level and in the same format. It treats keeping a user’s choice, consent or refusal, for 6 months as good practice. The UK ICO tested the 1,000 most visited sites in the country, and according to its 4 December 2025 update 979 passed its checks: no advertising cookies before choice, refusal as easy as acceptance, no cookies after refusal.

Is it working? In August Germany’s data protection commissioner (BfDI) published a survey: three quarters of participants would reject cookies more often if it were as easy as accepting. To me that says refusing is still harder than accepting. Commissioner Louisa Specht-Riemenschneider proposes central cookie managers where preferences are set once. The European Commission had proposed browser settings, but EU capitals dropped the idea in June after lobbying from advertising and media groups. Tech Policy Press says enforcement is inconsistent and banners became a tool of manipulation, not choice. Hard to disagree.

Does tracking without cookies need consent too

Generally yes. Dropping cookies does not switch off Article 5(3) if the site stores something on the device or reads data from it. Three techniques show it:

• Fingerprinting. A site queries the operating system, GPU drivers, screen resolution, time zone, fonts and hardware, and a browser fingerprint is built from that. Safari (since iOS 17 and macOS Sonoma), Firefox and Brave have protection, and Chrome has none after Google shut down Privacy Sandbox in April 2025 (more in browser privacy).
• Pixels. TikTok collects data from sites using its pixel even from people without the app, and the BBC saw data on cancer diagnoses, fertility and mental health crises. TikTok says it informs users and prohibits advertisers from sharing sensitive information.
• IP address. From 4 August Google lets third parties use IP addresses for ad personalisation in the European Economic Area, the UK and Switzerland, and puts the consent duty on advertisers. The UK ICO called the move irresponsible and in May 2026 suggested consent should stay mandatory for cross-site tracking. Under the EDPB guidelines Article 5(3) applies to IP-only tracking when the address originates from the user’s device. I side with the ICO: if the advertiser must collect consent, you cannot check that it did.

Contextual advertising avoids the problem only if it reads nothing from the device. It picks an ad from the page content, not from data about the person, so it needs no cookie and no consent to profiling. It has a price: a study by Implement Consulting Group for Google found a 66 percent loss of effectiveness when moving to contextual ads. The line can be thin. On 17 September 2026 the Cologne court held that ads chosen from Snap’s My AI prompts were not merely contextual, because the prompt text falls under GDPR Article 9.

Enforcement and lawsuits: what happened to cookies in 2026

Enforcement is growing mostly around pixels and refusals that do not work:

• Songkick. Illinois residents Zoe Barker and Charissa Baron filed a class action against Songkick, claiming it tracked visitors after they clicked reject all. The banner asked consent for 953 partners but rejecting did not stop tracking. The complaint cites the Illinois Eavesdropping Act and the Federal Wiretap Act.
• Email pixels. Authorities in Europe and Canada require explicit opt-in before open-tracking pixels and link wrapping in email. The CNIL recommendation on tracking pixels in emails allows an exception for measuring deliverability if the sender can demonstrate it is needed. Amazon SES does not insert pixels by default; tracking switches on only when OPEN or CLICK events are added.
• Health. Doctoralia, the world’s largest doctor appointment platform, removed its trackers after a Markup investigation. They had sent specialties, appointment times and doctors’ names to LinkedIn, TikTok and Google.
• Consent in ad auctions. Norway’s Datatilsynet fined Xandr, the ad firm of Microsoft, a record penalty in its history. Xandr was a joint controller and should have obtained explicit consent from Grindr users, but assumed Grindr had it.
• Outside Europe. Australia’s draft privacy bill would treat cookies and pixels in programmatic advertising as trading personal data that needs explicit consent.

Consent is also becoming a business model: OpenAI builds its European ChatGPT advertising on consent, and users who refuse see contextual ads. The market fed by such data is covered under data brokers.

What the Digital Omnibus changes and will banners disappear

Not soon. The Digital Omnibus would move the rules on personal data on devices from ePrivacy into the GDPR. According to the European Commission (page dated 20 November 2025, checked 16 October 2026), the proposal of 19 November 2025 gives banners a single-click reject button, makes websites respect the choice for at least six months, and lets people set preferences centrally, for example in the browser. Statistics and aggregated audience measurement would go on a list of exceptions without consent (Article 88a(3)(c): measurement solely for the controller’s own use, details in Articles 88a and 88b of proposal COM(2025) 837).

None of this is in force. In autumn 2025 the Commission proposed automated signals, set once in the browser, and by late July the tracking industry, led by Google according to the Kill the Cookie Banner campaign, was pushing back. The matter remains contested in the Council and Parliament. The current stage is tracked in GDPR, AI and the EU Digital Omnibus. It is a second attempt after the ePrivacy Regulation: the Commission proposed it in 2017 and withdrew it in 2025. In Poland, Article 399(2) already lets a user consent through software settings, but that is a user’s choice, not a duty for websites to honour browser signals.

My assessment: banners will be with us for a long time, and what changes will depend on lobbying, not on technology.

What it means for you

• If you run a site: put a reject button on the first layer in the same format as accept, remove pre-ticked boxes, do not file analytics or advertising under ‘strictly necessary’, and set no advertising or analytics cookies before the choice. Then open your browser’s developer tools and check that none appear after a refusal. That is exactly what the Songkick complaint alleges.
• Remember pixels in newsletters, ad tags and SDKs. The same rules apply, and CNIL expects consent before open-tracking pixels.
• If you are a user: click ‘reject all’, use a browser with tracking and fingerprinting protection (browser privacy) and check your fingerprint with EFF’s Cover Your Tracks. The wider picture is in online tracking.

Still open: whether the Digital Omnibus is adopted in this form, how Polish authorities apply Article 399 in disputes over refused cookies, and whether US courts accept that tracking tools are eavesdropping devices.