{ "name": "Cookievo Cookie Consent Rules", "title": "Cookie Consent Rules", "url": "https://cookievo.com/datasets/cookie-consent-rules/", "csv": "https://cookievo.com/datasets/cookie-consent-rules.csv", "markdown": "https://cookievo.com/datasets/cookie-consent-rules/index.md", "computed_at": "2026-10-21", "license": "https://cookievo.com/terms", "headline": "The Cookie Consent Rules carries 3 published figures read from 1 source's own page, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.", "quotes": [ "The Cookie Consent Rules carries 3 published figures read from 1 source's own page, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.", "3 of the 27 named sources read in full publish a figure; 24 publish none, read 17 October 2026.", "Cookie Consent Rules, requirement GDPR Article 83(4): maximum administrative fine: median 10,000,000 EUR across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement GDPR Article 83(5): maximum administrative fine: median 20,000,000 EUR across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement GDPR Article 83(6): non-compliance with a supervisory authority order: median 20,000,000 EUR across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement Quebec: notice before creating a biometric database: median 60 day across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement Australia: agency response to an access request: median 30 day across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement GDPR Article 8(1): age at which a child can consent to information society services: median 16 year across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement GDPR Article 8(1): lowest age of consent a member state may set: median 13 year across 1 source, read 17 October 2026.", "Cookie Consent Rules, requirement GDPR Article 12(3): time to act on a data subject request: median 1 month across 1 source, read 17 October 2026." ], "citation": "\"Cookievo Cookie Consent Rules\", updated 2026-10-21, https://cookievo.com/datasets/cookie-consent-rules/.", "changed_since": null, "national": { "unit": "EUR", "n": 3, "median": 20000000, "min": 10000000, "max": 20000000, "p25": 10000000, "p75": 20000000, "mean": 16666666.6667, "units": { "EUR": 3, "day": 2, "month": 1, "year": 2 }, "published_sources": 3, "named_sources": 30, "read_sources": 27, "not_published": 24, "published_share": 0.111 }, "by_axis": { "requirement": { "GDPR Article 83(4): maximum administrative fine": { "EUR": { "n": 1, "median": 10000000, "min": 10000000, "max": 10000000, "p25": 10000000, "p75": 10000000, "mean": 10000000 } }, "GDPR Article 83(5): maximum administrative fine": { "EUR": { "n": 1, "median": 20000000, "min": 20000000, "max": 20000000, "p25": 20000000, "p75": 20000000, "mean": 20000000 } }, "GDPR Article 83(6): non-compliance with a supervisory authority order": { "EUR": { "n": 1, "median": 20000000, "min": 20000000, "max": 20000000, "p25": 20000000, "p75": 20000000, "mean": 20000000 } }, "Quebec: notice before creating a biometric database": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "Australia: agency response to an access request": { "day": { "n": 1, "median": 30, "min": 30, "max": 30, "p25": 30, "p75": 30, "mean": 30 } }, "GDPR Article 8(1): age at which a child can consent to information society services": { "year": { "n": 1, "median": 16, "min": 16, "max": 16, "p25": 16, "p75": 16, "mean": 16 } }, "GDPR Article 8(1): lowest age of consent a member state may set": { "year": { "n": 1, "median": 13, "min": 13, "max": 13, "p25": 13, "p75": 13, "mean": 13 } }, "GDPR Article 12(3): time to act on a data subject request": { "month": { "n": 1, "median": 1, "min": 1, "max": 1, "p25": 1, "p75": 1, "mean": 1 } } } }, "rows": [ { "source": "GDPR (Regulation 2016/679) official text", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "10 000 000 EUR", "value": 10000000, "unit": "EUR", "vat": null, "axis": { "requirement": "GDPR Article 83(4): maximum administrative fine" }, "retrieved_at": "2026-10-16", "quote": "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "GDPR (Regulation 2016/679) official text", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "20 000 000 EUR", "value": 20000000, "unit": "EUR", "vat": null, "axis": { "requirement": "GDPR Article 83(5): maximum administrative fine" }, "retrieved_at": "2026-10-16", "quote": "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "GDPR (Regulation 2016/679) official text", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "20 000 000 EUR", "value": 20000000, "unit": "EUR", "vat": null, "axis": { "requirement": "GDPR Article 83(6): non-compliance with a supervisory authority order" }, "retrieved_at": "2026-10-16", "quote": "Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "CAI Quebec - principaux changements de la loi 25", "url": "https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25", "figure": "60 jours", "value": 60, "unit": "day", "vat": null, "axis": { "requirement": "Quebec: notice before creating a biometric database" }, "retrieved_at": "2026-10-17", "quote": "La Loi prévoit un nouveau délai pour divulguer à la Commission (PDF, 326 Ko) la création d’une banque de caractéristiques ou de mesures biométriques. Celle-ci doit désormais être divulguée à la Commission au plus tard 60 jours avant sa mise en service.", "source_class": "primary-government", "text_sha256": "7636eb4dc0fee39eb33dba6ff37a03b751428ed5a85b1014ad91317ee8ec8b36" }, { "source": "OAIC - read the Australian Privacy Principles", "url": "https://www.oaic.gov.au/privacy/australian-privacy-principles/read-the-australian-privacy-principles", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "requirement": "Australia: agency response to an access request" }, "retrieved_at": "2026-10-17", "quote": "if the entity is an agency — within 30 days after the request is made; or", "source_class": "primary-government", "text_sha256": "3bcdc2f2877ba3cd703bc869d3f2d722b14c55016710d288dcee20fbd7bdac1c" }, { "source": "GDPR (Regulation 2016/679) official text", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "16 years", "value": 16, "unit": "year", "vat": null, "axis": { "requirement": "GDPR Article 8(1): age at which a child can consent to information society services" }, "retrieved_at": "2026-10-16", "quote": "Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old.", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "GDPR (Regulation 2016/679) official text", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "13 years", "value": 13, "unit": "year", "vat": null, "axis": { "requirement": "GDPR Article 8(1): lowest age of consent a member state may set" }, "retrieved_at": "2026-10-16", "quote": "Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "GDPR (Regulation 2016/679) official text", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "figure": "one month", "value": 1, "unit": "month", "vat": null, "axis": { "requirement": "GDPR Article 12(3): time to act on a data subject request" }, "retrieved_at": "2026-10-16", "quote": "In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue del", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" } ], "not_published": [ { "source": "ICO guide to PECR: cookies and similar technologies", "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/", "retrieved_at": "2026-10-19", "reason": "read in full and no accepted figure on the page" }, { "source": "PECR 2003 regulation 6 (statute text)", "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/6", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "CNIL - les regles a suivre pour les cookies", "url": "https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "CNIL lignes directrices modificatives et recommandation", "url": "https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices-modificatives-et-recommandation", "retrieved_at": "2026-10-17", "reason": "every candidate on the page was refused" }, { "source": "CNIL questions-reponses on the cookie guidelines", "url": "https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "EDPB report of the cookie banner taskforce", "url": "https://www.edpb.europa.eu/our-work-tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "ePrivacy Directive 2002/58/EC (consolidated text)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058", "retrieved_at": "2026-10-17", "reason": "every candidate on the page was refused" }, { "source": "California Attorney General - CCPA", "url": "https://oag.ca.gov/privacy/ccpa", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "CPPA regulations index", "url": "https://www.cppa.ca.gov/regulations/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "CPPA - the California Consumer Privacy Act regulations", "url": "https://cppa.ca.gov/regulations/consumer_privacy_act.html", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "OAIC - tracking pixels and privacy obligations", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/tracking-pixels-and-privacy-obligations", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "OAIC - Australian Privacy Principles guidelines", "url": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines", "retrieved_at": "2026-09-12", "reason": "every candidate on the page was refused" }, { "source": "OPC Canada - guidelines on privacy and online behavioural advertising", "url": "https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "OPC Canada - policy position on online behavioural advertising", "url": "https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/bg_ba_1206/", "retrieved_at": "2026-09-26", "reason": "every candidate on the page was refused" }, { "source": "Garante - cookie topic index", "url": "https://www.garanteprivacy.it/temi/cookie", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Garante - linee guida cookie e altri strumenti di tracciamento (10 giugno 2021)", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876", "retrieved_at": "2026-10-03", "reason": "read in full and no accepted figure on the page" }, { "source": "Datatilsynet (Denmark) English index", "url": "https://www.datatilsynet.dk/english", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "CAI Quebec - lois et reglements", "url": "https://www.cai.gouv.qc.ca/commission-acces-information/lois-reglements", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "Irish DPC - guidance on cookies and other tracking technologies", "url": "https://www.dataprotection.ie/en/dpc-guidance/guidance-cookies-and-other-tracking-technologies", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "Irish DPC - what is the law on the use of cookies?", "url": "https://www.dataprotection.ie/en/faqs/cookies/what-law-use-cookies", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "AEPD - update to the guia sobre el uso de las cookies", "url": "https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/aepd-actualiza-guia-cookies-para-adaptarla-a-nuevas-directrices-cepd", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "AEPD guia sobre el uso de las cookies (PDF)", "url": "https://www.aepd.es/sites/default/files/2020-07/guia-cookies.pdf", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "Colorado Attorney General - universal opt-out mechanisms", "url": "https://coag.gov/opt-out/", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "Colorado Attorney General - Colorado Privacy Act", "url": "https://coag.gov/resources/colorado-privacy-act/", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/", "label": "ICO guide to PECR: cookies and similar technologies", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/6", "label": "PECR 2003 regulation 6 (statute text)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies", "label": "CNIL - les regles a suivre pour les cookies", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices-modificatives-et-recommandation", "label": "CNIL lignes directrices modificatives et recommandation", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ", "label": "CNIL questions-reponses on the cookie guidelines", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.edpb.europa.eu/our-work-tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en", "label": "EDPB report of the cookie banner taskforce", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058", "label": "ePrivacy Directive 2002/58/EC (consolidated text)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "label": "GDPR (Regulation 2016/679) official text", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://oag.ca.gov/privacy/ccpa", "label": "California Attorney General - CCPA", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cppa.ca.gov/regulations/", "label": "CPPA regulations index", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://cppa.ca.gov/regulations/consumer_privacy_act.html", "label": "CPPA - the California Consumer Privacy Act regulations", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/tracking-pixels-and-privacy-obligations", "label": "OAIC - tracking pixels and privacy obligations", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines", "label": "OAIC - Australian Privacy Principles guidelines", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.oaic.gov.au/privacy/australian-privacy-principles/read-the-australian-privacy-principles", "label": "OAIC - read the Australian Privacy Principles", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/", "label": "OPC Canada - guidelines on privacy and online behavioural advertising", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/bg_ba_1206/", "label": "OPC Canada - policy position on online behavioural advertising", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.garanteprivacy.it/temi/cookie", "label": "Garante - cookie topic index", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876", "label": "Garante - linee guida cookie e altri strumenti di tracciamento (10 giugno 2021)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.datatilsynet.dk/english", "label": "Datatilsynet (Denmark) English index", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037823034", "label": "Legifrance - article 82, loi Informatique et Libertes", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/media2/kz0doybw/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf", "label": "ICO guidance on the use of storage and access technologies (PDF)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25", "label": "CAI Quebec - principaux changements de la loi 25", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.cai.gouv.qc.ca/commission-acces-information/lois-reglements", "label": "CAI Quebec - lois et reglements", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.dataprotection.ie/en/dpc-guidance/guidance-cookies-and-other-tracking-technologies", "label": "Irish DPC - guidance on cookies and other tracking technologies", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.dataprotection.ie/en/faqs/cookies/what-law-use-cookies", "label": "Irish DPC - what is the law on the use of cookies?", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/aepd-actualiza-guia-cookies-para-adaptarla-a-nuevas-directrices-cepd", "label": "AEPD - update to the guia sobre el uso de las cookies", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.aepd.es/sites/default/files/2020-07/guia-cookies.pdf", "label": "AEPD guia sobre el uso de las cookies (PDF)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://coag.gov/opt-out/", "label": "Colorado Attorney General - universal opt-out mechanisms", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://coag.gov/resources/colorado-privacy-act/", "label": "Colorado Attorney General - Colorado Privacy Act", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.edpb.europa.eu/about-edpb/about-edpb/members_en", "label": "edpb.europa.eu", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 3 of the 27 named sources that could be read published a usable figure; 24 published none and are recorded as not published, never filled in; 3 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in EUR (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 3 figures, never sentences; 49 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per jurisdiction per requirement, each quoted verbatim from that jurisdiction's own authority with the effective date and the article or regulation it sits in; across the rows, the comparison nobody publishes - which requirements are universal, which are EU-only, where the US state regimes diverge from consent-first, and which jurisdictions exempt analytics - plus the changed-since diff every time an authority reissues its guidance, which is the news when a regulator moves", "embed": "

10,000,000 to 20,000,000 EUR

3 published figures, Cookie Consent Rules, across 1 source, read 17 October 2026

Source: Cookievo Cookie Consent Rules
" }