Privacy Insights That Matter

Cookie Banner Dark Patterns: The New Manipulation Tactics Regulators Are Targeting

France's CNIL fined Google €200 million in September 2025 for a consent design that made cookie rejection harder than acceptance. The same month, SHEIN received €150 million — not for failing to show a banner, but for a banner that accepted a user's "Reject all" click while continuing to place cookies anyway. Sweden's Data Protection Authority fined ATG and Warner Music Sweden for manipulative banner designs. American Express received enforcement action in the UK after cookies continued firing after user withdrawal. These are not edge cases or giant-tech-only problems. Enforcement has shifted from warnings to immediate fines without prior notice. Dark pattern enforcement has become a distinct and growing enforcement category.