Cookie fines in Italy: what is really at stake and who gets fined

Multi-million fines and real ones

Search for “cookie fines” and you almost always find two numbers: 20 million euro, or 4% of worldwide turnover. They are real figures, but they are the legal maximum, not what happens to a company website with a faulty banner.

We read the decisions published by the Italian Data Protection Authority (Garante Privacy) from 2024 to today. For cookies alone, the small and medium-sized business websites that were checked received a reprimand and an order to comply, with no fine. In none of the decisions we found was a violation involving only cookies punished with a money fine.

That does not mean cookies can be ignored. It means the risk needs to be measured properly: who checks, what they find, what happens the first time and what happens the second.

The rules in force

In Italy cookies and other tracking tools are governed by article 122 of the Privacy Code, the GDPR and the Garante's Cookie Guidelines, adopted on 10 June 2021 and applied since January 2022 (Garante Privacy). In short:

• technical cookies need only a notice, not consent;
• all others, from advertising to profiling, start only after consent;
• closing the banner with the X counts as refusing, and refusing must be as easy as accepting;
• scrolling the page is not consent;
• after a choice, the banner must not be shown again for 6 months, unless something significant changes;
• analytics are treated as technical cookies only if anonymised and used for aggregate statistics on a single site.

So the banner is not mandatory for everyone: it is only needed if the site uses non-technical tools. We covered this in A website without a cookie banner.

Who checks and who is really at risk

Since 2022 the Garante has tasked the Guardia di Finanza's special privacy unit with online checks of e-commerce and other operators, partly because of the many complaints it received. Sites are chosen by size and geographic criteria, checked remotely and, months later, the Garante opens proceedings. The decisions themselves say so (Garante Privacy).

Those checked are not multinationals: boat-trip agencies, ferry companies, online shops, car dealers, sole traders. You do not have to be large to be checked, but so far you have not had to be large to get away with a reprimand either.

Other routes to proceedings are a user complaint and inquiries the Garante opens on its own initiative, usually on high-profile sectors or cases, such as the one on newspaper websites and cookie walls (Il Post).

Fines actually imposed so far

These are the cookie-only decisions arising from Guardia di Finanza checks that we found between 2024 and 2025. The outcome is always the same.

The specialist press also noted that these were reprimands, not fines (ItaliaOggi). The Garante explains its choice briefly, citing “the specific features of the investigation”.

The second time is different. Every reprimand goes into the Garante's internal register. Previous violations are one of the criteria for setting a future fine, and failing to comply with a Garante order itself falls into the tier of up to 20 million or 4% of turnover. The reprimand is free, but it is the last warning.

What really matters

The first four mistakes on the list recur in the decisions; the fifth is the basic rule of the guidelines. These are the things to check first:

1. 01

   Missing or outdated cookie notice

   No cookie policy, one citing repealed laws, or a privacy notice that does not mention cookies.

2. 02

   A banner that does not say what the site does

   The banner does not make clear whether the site uses only technical cookies or other tools too.

3. 03

   Hard to refuse

   There is no button to refuse, or the X is not treated as a refusal.

4. 04

   A banner that comes back on every visit

   After a choice it must not be shown again for 6 months.

5. 05

   Tools running before consent

   Advertising pixels and non-anonymised analytics must start only after a yes.

A banner installed and never checked again is the most common case. The site changes, a video, a new pixel or a plugin arrives: the banner stays the one from three years ago.

A banner done properly, or no banner

Fear of multi-million fines often leads people to install the first banner they find and forget about it. The real risk is different: a check, a reprimand, having to redo everything in a hurry and, the next time, a real fine.

At Cloudfactory we start from what the site actually installs. Often it turns out the banner can be removed, by replacing the tools that make it necessary. When it is needed, we use CF Consent, our consent manager built on the Garante's guidelines. Send us your site's address: we will tell you what needs fixing and what does not.

How we wrote this article

At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them.

Frequently asked questions

Sources

1. Garante Privacy, Guidelines on cookies and other tracking tools, 10 June 2021
2. Garante Privacy, decision of 13 November 2024 (reprimand, e-commerce)
3. Garante Privacy, decision of 4 June 2025 (reprimand, car dealer)
4. Garante Privacy, guidelines on tracking pixels in email, 17 April 2026
5. Brocardi, Privacy Code, art. 166
6. MioLegale, Privacy Code, art. 162 (repealed)
7. ItaliaOggi, Privacy, caos cookie sui siti internet (21 January 2025)
8. Il Post, Garante inquiry into newspaper cookies (21 October 2022)
9. iubenda, Cookie Solution: evita le sanzioni
10. CNIL, fines on Google and SHEIN (September 2025)
11. DLA Piper, CNIL fines Facebook and Google (January 2022)
12. Punto Informatico, fine on Condé Nast (December 2025)
13. EU Digital Policy, status of the Digital Omnibus