Reject all, on the first layer: what the 2025 CNIL decisions changed for every cookie banner

What the CNIL found

On 1 September 2025 the CNIL fined the Irish subsidiary that runs shein.com €150 million. The decision is unusually concrete about the mechanics. The first banner offered “Cookie settings”, “Reject all” and “Accept”, but said nothing about the advertising purpose of the cookies. Worse, when a visitor clicked Reject all, or later withdrew consent, new cookies were still written and existing ones kept being read. The second layer, reached through “Cookie settings”, did not name the third parties that would set cookies. Three separate failures, and the refusal button was the one that made headlines: it did not do what it said.

Two days later the CNIL published its Google decision: €200 million for Google LLC and €125 million for Google Ireland, €325 million together. The cookie part of that decision is about asymmetry. In the account creation flow, until October 2023, a person who chose “express personalisation” needed six clicks to refuse personalised advertising cookies and two to accept them. The CNIL’s wording is the important part: that imbalance compromised the free nature of consent. Consent that costs more to refuse than to give is not freely given, and consent that is not freely given is not consent.

Neither decision invented a new rule. Both applied Article 5(3) of the ePrivacy Directive and the GDPR definition of consent to a specific interface, and both are worth reading as an engineer rather than as a lawyer, because every finding maps to a line of code or a line of copy.

The guideline behind the fines

The European Data Protection Board adopted Guidelines 03/2022 on deceptive design patterns in March 2022. They are written for social media interfaces, but the cookie banner section has been quoted by every European regulator since. The line that matters: the first layer of a cookie banner should have a clear button that lets people reject all cookies, and a banner without one does not give an easy choice, which infringes the right to freely given consent. The guidelines sort deceptive design into six families (overloading, skipping, stirring, obstructing, fickle, left in the dark) and a cookie banner can manage to hit four of them on one screen: a hidden reject option, a coloured accept button next to a grey link, an “×” that counts as yes, and a wall of purposes nobody reads.

In January 2023 the EDPB’s cookie banner task force published its report, and it reads like a list of things the CNIL would later fine: no reject button on the first layer, pre-ticked boxes, a link styled to look like body text where a button was expected, contrast that makes the refuse option disappear, and legitimate interest offered as an alternative to consent. Since then the pattern of enforcement has been steady rather than spectacular, until 2025, when the amounts changed.

What a first layer has to do

Strip the decisions and the guideline down and you get six requirements. They are small, they are checkable, and every one of them has failed somebody expensively.

1. Reject on the first layer. Not on the second layer, not after a settings click. On the same screen as Accept.
2. Same weight. Same size, same visual weight, same position in the reading order. A white “Reject” next to a black “Accept” is a stirring pattern; a text link next to a button is obstruction.
3. Purposes, not adjectives. “Analytics” and “Marketing” are purposes. “To improve your experience” is not information; the SHEIN decision says so about the missing advertising purpose.
4. The legal pages one click away. The cookie declaration, the privacy policy and, in Germany, the imprint. If the second layer exists it has to name the third parties.
5. No consent by closing. An “×” or a scroll or a click outside the box is not a choice. The banner stays until a choice is made, or closes as a refusal.
6. A way back in. Withdrawing has to be as easy as consenting (Article 7(3)). A persistent control or a footer link that reopens the banner, on every page.

Behind the banner: nothing loads

The SHEIN finding that hurts most is not about the buttons. It is that Reject all did not stop the cookies. That failure is invisible in a screenshot and obvious in a scan, and it is the reason a banner is only half of a consent tool. The other half is the code that holds every analytics, advertising and social script until its category is granted, and the check that proves it did.

In practice that means the consent runtime is the first script in the head, so nothing above it can set a cookie the runtime cannot take back. Every consent-bound tag is inert (type="text/plain" with a category) until the category is granted. Everything a scan found on the site that is not tagged is neutralised by host. And the site is scanned again, on a schedule, with consent denied, so a pixel added by someone’s tag manager experiment next month shows up as a dated finding instead of a surprise in a regulator’s letter. That is what the scanner and the install check exist for.

A checklist you can run today

• Open your site in a private window. Is Reject all on the first screen, the same size as Accept all?
• Click Reject all. Open the browser’s storage panel. Are there analytics or marketing cookies? If yes, the banner is cosmetic.
• Click Accept all, then find the way back to the banner from a random page. Count the clicks. Compare with the clicks to accept.
• Read the first layer. Does it name purposes? Does it link to the cookie declaration and the privacy policy?
• Run the free scan on your homepage. It reads the HTML and lists the trackers that would fire before consent.

If any line fails, the fix is usually an afternoon. The fines are for sites that did not check.

Sources

1. CNIL, “Cookies placed without consent: SHEIN fined 150 million euros by the CNIL”, 3 September 2025
2. EDPB, national news: French SA fines SHEIN 150 000 000 EUR, September 2025
3. Gerrish Legal, “CNIL fines Google €325M and SHEIN €150M for breaking cookie rules”, September 2025
4. Slaughter and May, “Cookie catch-up: what you need to know about the CNIL’s Google and Shein fines”, 2025
5. EDPB, Guidelines 03/2022 on deceptive design patterns in social media platform interfaces, adopted 14 March 2022
6. Cookie Information, “Cookie banner dark patterns: CNIL’s enforcement is real and it’s escalating”, 2025

Written by the CookieCrumbs team, published 5 September 2026. Facts carry their dates; if one has moved on, tell us and we will correct it.