GDPR Cookie Consent Requirements in 2026: 7 Enforcement-Driven Checks for the Digital Omnibus Era
If your team is reviewing gdpr cookie consent requirements on August 28, 2026, the regulatory landscape has shifted in ways that directly affect what your compliance program needs to cover. The European Data Protection Board’s 2026 Coordinated Enforcement Framework action launched on March 19, 2026, directing 25 Data Protection Authorities to examine obligations of transparency and information under the GDPR. France’s CNIL has issued 23 simplified-procedure sanctions for improper cookie compliance in 2026 alone. Meanwhile, the European Commission’s Digital Omnibus proposal — which would introduce new GDPR Articles 88a and 88b to replace the stalled ePrivacy Regulation — continues to move through the legislative process, with the Council deleting Article 88b (browser-level consent signals) from its position on June 18, 2026.
This article is not a primer on consent basics. If you want the foundational GDPR cookie consent requirements first, read our guide to cookie consent best practices and cookie consent banner examples. This post covers seven enforcement-driven checks shaped by what regulators are actively examining in 2026 — the EDPB’s coordinated transparency sweep, CNIL’s simplified-procedure practice, and the developing Digital Omnibus framework.
What the EDPB’s 2026 coordinated enforcement action changes
The EDPB’s Coordinated Enforcement Framework for 2026 focuses on Articles 12, 13, and 14 of the GDPR — the transparency and information obligations that sit at the foundation of any compliant cookie program. The action launched on March 19, 2026 with participation from 25 DPAs across the EEA. During the second half of 2026, participating authorities are sharing and discussing their findings on these obligations.
For cookie consent programs, the relevant obligations under Article 13 include disclosing what data is collected through cookies, what purposes it serves, how long cookies persist, which third parties receive the data, and how users can exercise their rights. These disclosures must be accurate, concise, intelligible, easily accessible, and in clear language — conditions that many current cookie notices and banners do not fully meet.
The practical implication for gdpr cookie consent requirements is that regulators are not only looking at whether consent is technically obtained. They are looking at whether the information provided to users at the point of consent is complete, honest, and understandable. That is a broader audit than most teams run.
1. Non-essential trackers stay blocked before any consent action
This is the baseline requirement, and it remains the most common enforcement finding.
CNIL’s 2025 sanction notices — including the €1.5 million fine against American Express Carte France in November 2025 — consistently cite the placement of advertising cookies before any user choice. The SHEIN €150 million fine the same year included the same defect: advertising cookies fired on page load before the user interacted with the banner. CNIL’s guidance is explicit: non-essential cookies must not be set before explicit consent is obtained.
The check is mechanical: open the browser developer tools on a first visit, load the page without any interaction, and confirm that non-essential cookies, pixels, tags, and tracking scripts have not fired or set storage values. Then test the reject path. A common failure is that reject closes the banner but optional trackers still load because the trigger logic only checks whether the banner was dismissed, not whether consent was granted.
If the site uses a tag manager, test the tag manager container directly. Tags can fire from the container before the CMP fires a consent signal, particularly when optimization tools or third-party scripts pre-trigger based on page load rather than waiting for a consent state.
2. The first-layer banner gives equal prominence to reject
The EDPB’s enforcement guidance and CNIL’s practice converge on this point: the reject option must appear on the first layer of the consent interface. Regulators have specifically cited dark-pattern designs — high-contrast accept buttons paired with low-visibility or multi-step reject paths — as non-compliant.
CNIL’s requirements for cookie consent include presenting “Accept all” and “Refuse all” (or “Continue without accepting”) options with equal prominence and ease of use. The EDPB’s general guidance on consent reinforces that freely given consent requires an equivalent, frictionless alternative to accepting tracking.
This check requires both a visual review and a behavioral test. Visually: does the banner show a reject or equivalent “no thanks” action that is visually comparable to the accept option in terms of button size, color contrast, and position? Behaviorally: does clicking reject actually stop optional tracking, or does it open a second panel that requires additional steps?
If your design team or CMP vendor calls the reject path a “manage preferences” button that routes to a full preference center, treat that as a potential compliance gap rather than an acceptable design choice.
3. Information disclosures match what the site actually does
This is the specific obligation that the EDPB’s 2026 coordinated enforcement action is examining.
GDPR Article 13 requires disclosure of the controller’s identity and contact details, the data protection officer’s contact information where applicable, the purposes and legal basis of processing, the categories of personal data involved, recipients or categories of recipients, and details of any transfers to third countries. For cookie programs, that means the cookie notice or banner must accurately reflect which technologies are in use, who receives data through them, and how long data persists.
CNIL’s enforcement practice reinforces this obligation. The €325 million fine against Google in 2025 specifically cited insufficient information about cookie purposes. A common failure mode is the generic cookie notice that lists categories like “analytics” or “marketing” without naming the specific vendors or explaining what those categories actually do. Another is a privacy policy that was written when the site used three trackers and now uses thirty.
The test: compare what your current cookie notice says against what your tag manager, analytics tools, ad stack, and embedded third-party content actually do. Any gap is an audit risk under gdpr cookie consent requirements.
4. Granular consent separates purposes, not just categories
The GDPR requires consent to be specific to the purposes of processing. For cookie programs, that means users must be able to consent to analytics, advertising, and personalization separately — not as a single combined switch.
The European Commission still describes valid consent as “freely given, specific, informed and unambiguous”. The EDPB reinforces that granular control must be technically meaningful, not just a visual toggle that maps to the same underlying tag behavior. CNIL’s enforcement guidance has consistently treated bundled consent as insufficient.
The granular check: after testing individual category toggles in the consent preference center, verify that each denied category actually prevents its associated vendors from firing. A category toggle that appears to save a “denied” state but still allows the vendor to load through a fallback mechanism is not granular consent under gdpr cookie consent requirements — it is a UI fiction.
5. Withdrawal works and changes the live state immediately
GDPR Article 7 gives users the right to withdraw consent as easily as they gave it. The EDPB’s 2026 coordinated enforcement focus on transparency obligations includes the withdrawal mechanism, because information about how to withdraw consent is itself a disclosure requirement under Article 13.
CNIL’s 2025 American Express sanction specifically cited cookies continuing to run after consent was withdrawn — a defect that persisted despite the company’s apparent consent management system. This is a common failure: the UI updates to show the user’s new preference, but the technical implementation does not propagate the change to the tag layer.
The withdrawal check: grant consent to all categories, verify the trackers fire, then use the persistent settings path to withdraw, and confirm in the browser’s network panel that denied categories actually stop making requests. Do not rely solely on the CMP’s UI state indicator.
6. “Consent or pay” models are evaluated against real choice
The EDPB’s Opinion 08/2024 on “consent or pay” models — where users must either pay a subscription or accept tracking — remains the current guidance on this practice. The EDPB’s position is that these models generally fail to meet gdpr cookie consent requirements because they do not constitute freely given consent when personal data is treated as a tradable commodity and the fundamental right to data protection requires payment to exercise.
The EDPB advises that large online platforms should offer an “equivalent alternative” that does not require users to consent to the processing of personal data for behavioral advertising. For publishers and businesses considering paid tiers as an alternative to ad-funded tracking, the current guidance requires genuine equivalence, not just a nominal free option with materially degraded functionality.
For this check: confirm that any “consent or pay” model on your platform offers a meaningful free option, and that consent is not the only path to functional access.
7. The Digital Omnibus framework: what Article 88a changes for current programs
While the Digital Omnibus proposal is not yet in force, understanding what Article 88a would introduce helps teams future-proof current gdpr cookie consent requirements.
The European Commission published the Digital Omnibus proposal in November 2025, following the withdrawal of the ePrivacy Regulation on February 11, 2025. Article 88a would consolidate cookie governance directly into the GDPR, transferring enforcement responsibility from telecoms regulators to Data Protection Authorities. The Council adopted its position on the proposal on June 18, 2026 — with a notable change: Article 88b, which would have mandated recognition of browser-level consent signals within 24 months, was deleted from the Council’s text.
Key provisions that Article 88a would codify from existing gdpr cookie consent requirements:
- Consent must be granular, easy to withdraw, and obtained before cookies are set
- Pre-ticked boxes and dark patterns are explicitly prohibited
- A new six-month prohibition on re-requesting consent for the same purpose after a user has refused
- Specific exceptions where consent would not be required (e.g., sole purpose of transmitting electronic communication, providing an explicitly requested service, aggregated audience measurement for the controller’s own use, security-related purposes)
Under optimal circumstances, the Digital Omnibus could be adopted in the third quarter of 2026, with Article 88a becoming applicable six months after entry into force. Until then, the existing ePrivacy Directive continues to govern alongside the GDPR.
The practical takeaway for gdpr cookie consent requirements in 2026: build programs that already meet the granular, transparent, and easily withdrawn standards that Article 88a would codify. The enforcement infrastructure — EDPB coordinated actions, CNIL’s active simplified-procedure practice, and DPA attention to Articles 12, 13, and 14 — already exists to enforce these obligations.
A practical enforcement-action audit
Before your next deployment, run through these seven checks with actual browser tools, not just a visual review:
- Open the browser network panel on a first visit with no interaction and confirm non-essential requests are absent.
- Inspect the banner’s first layer: accept and reject must be visually and mechanically equivalent.
- Compare the current cookie notice against the live tag manager, analytics, and ad stack configurations.
- Test each consent category separately and confirm each one changes the downstream network behavior.
- Grant full consent, then use the persistent settings path to withdraw, and verify in the network panel that denied categories stop.
- For any “consent or pay” model, confirm a genuinely equivalent free option exists.
- Review the current consent program against the granular, transparent, and withdrawal standards that the Digital Omnibus Article 88a would codify.
Bottom line
The gdpr cookie consent requirements in 2026 are shaped by active regulatory enforcement and evolving legislation. The EDPB’s 2026 coordinated action is examining transparency and information obligations specifically, CNIL’s 23 simplified-procedure sanctions in 2026 make the stakes concrete for any organization operating in France, and the Digital Omnibus framework — particularly Article 88a — would formalize many existing best practices into hard requirements.
The checks above are not abstract compliance recommendations. They are the specific areas that regulators are examining right now, reinforced by concrete enforcement actions and a legislative trajectory that points toward stricter, more harmonized cookie governance under the GDPR.
Sources
- EDPB: CEF 2026 launches coordinated enforcement action on transparency and information
- EDPB: Work Programme 2026-2027
- EDPB: Consent or pay models should offer real choice
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
- CNIL: Cookies placed without consent: Google fined 325 million euros
- CNIL: Cookies placed without consent: SHEIN fined 150 million euros
- CNIL: Cookies placed without consent: American Express Carte France fined 1.5 million euros
- CNIL: CNIL issues 23 sanctions under simplified procedure in 2026
- Cookie-Script: EDPB 2026 Coordinated Transparency Sweep
- SecurePrivacy: EU Digital Omnibus Article 88a Changes for Cookie Consent 2026
- Nixon Digital: Digital Omnibus GDPR Cookie Rules
- European Commission: Application of the GDPR
- European Commission: Legal grounds for processing data
- Two Birds: ePrivacy Regulation update
This post was published on August 28, 2026 using current official regulator, government, and platform materials available at publication time.