TL;DR for the DPO
Three charges recur in almost every decision: (1) non-essential cookies set BEFORE consent; (2) refusal harder than acceptance, by position, colour or number of clicks; (3) inadequate information. All three can be checked in two minutes on any website, with no special tools.
The three points that matter
- Symmetry is the heart of the matter: if accepting takes one click, refusing must take one too. Hiding refusal behind 'customise', or rendering it as faint text beside a coloured button, is by far the most frequent charge.
- Timing matters as much as form: no non-essential tracker may fire before the choice is made. Many banners are formally correct while the site has already loaded advertising scripts as the user reads.
- Jurisdiction follows the website, not the head office: an authority can act on any site accessible from its country. Being established elsewhere is not a defence.
What to do now, in practice
A two-minute check for every client: 1) open the site in a private window and count the clicks needed to refuse: more than one means a problem; 2) check the reject button has the same prominence as accept; 3) open developer tools and see whether requests go to advertising domains BEFORE any choice is made; 4) check withdrawal is possible and actually works, not merely stated; 5) verify the cookie policy lists the trackers actually present, not a generic list inherited from a template.
Why it matters for your clients
The banner is the only privacy obligation anyone can verify from the outside, in seconds, without access to anything. That makes it the first thing an authority, a competitor or an activist looks at. Our survey of Italian municipal websites shows roughly six banners in ten do not offer one-click refusal: this is not a niche problem, it is the norm.
Official source:CNIL - 2025-2026 enforcement activity on cookies and trackers (Article 82 of the French Data Protection Act, transposing the ePrivacy Directive)Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
