Is Your Website REALLY Legally In Compliance
With GDPR & CCPA Cookie Consent LAW?
REALLY?

Enterprise-grade consent management that helps you achieve GDPR, CCPA
& global compliance while enhancing your user experience.

Simplifying Compliance for the Modern Web

What’s The Use of a System Like This If You Can’t
Use It Where You Want?

We Integrate With Every Major Website and Shopping Cart Platform
There’s Just Too Many To List All, Here a Just a Few

WordPress

Squarespace

Clickfunnels

Webflow

Weebly

Shopify

WIX

Kajabi

This Isn’t About Scare Tactics, This Is About Real World Legal Issues!

If You Think There’s a Possibility Your Website Is Not In Compliance
With Worldwide Cookie and Privacy Laws… It Probably Is

The Hidden Legal Risk Your Website Faces Every Day

Are you aware that your website could be facing potential fines of up to $42,530 per violation under the California Consumer Privacy Act (CCPA)? Or that the General Data Protection Regulation (GDPR) can impose penalties of up to $22 million or 4% of your global annual revenue – whichever is higher?

These aren’t hypothetical scenarios. They’re the harsh reality facing businesses that fail to properly implement cookie consent management on their websites.

Why Cookie Compliance Matters Now More Than Ever

The digital landscape has transformed dramatically. What was once a simple matter of web design has evolved into a complex legal obligation with severe consequences for non-compliance. Every day, your website collects valuable data through cookies – small text files that track user behavior, preferences, and personal information.

But here’s what most business owners don’t realize: collecting this data without proper consent is now illegal in numerous jurisdictions worldwide.

Please…Don’t Make This Costly Mistake. This Applies To Everyone.

“It Doesn’t Apply To Me, My Company Is Not In Any Of Those Countries” That’s Where You’re Wrong… It’s Called, “Extraterritorial Reach”

No, your company does not need to be located in the country to receive GDPR or CCPA violations. Both regulations have extraterritorial scope, meaning they apply based on whose data you process, not where your business is physically located.

For GDPR: The GDPR applies to any company that collects or processes personal data of EU residents, regardless of the company’s location. This is why companies across the world, including many US-based organizations, have been fined under GDPR even though they have no physical presence in the EU.

For CCPA: The CCPA applies to businesses that collect personal information from California residents, even if the business is located outside California or even outside the United States. What matters is that you’re offering services or products to California residents and meet the other CCPA criteria regarding revenue or data volume.

This extraterritorial reach is one of the most significant aspects of modern data privacy laws. For example, a company based in Asia with no offices in Europe or the US could still be subject to both GDPR and CCPA if it:

  1. Collects or processes data from EU residents (triggering GDPR)
  2. Collects or processes data from California residents and meets the CCPA thresholds (triggering CCPA)

That’s why global companies often implement compliance programs that address both regulations, even if they don’t have a physical presence in those jurisdictions.

A Few Questions You May Have About The Service and Offer

Can’t I Just Use a WordPress Plugin For Consent?
The answer is of course you can except. You won’t have the advantages dedicated cookie consent platform service typically offers:

  • More comprehensive compliance with global privacy regulations like GDPR, CCPA, and ePrivacy
  • Directive across multiple regions
  • Advanced consent management with granular cookie categorization and user preference controls
  • Centralized management across multiple websites or platforms beyond just WordPress
  • Regular automatic updates to keep pace with changing regulations and requirements
  • Detailed analytics and reporting on consent rates and user interactions
  • More robust documentation and legal templates that are professionally maintained

Do I need a webmaster to use the service as customer of agency?

No. Our system works in a few simple steps. Add your website, copy the code given, then simply paste the code into the header of your website. That’s it. There’s no need for technical ability to use our service.

What about updates and law changes?Great question. As laws change and requirements change regarding cookie consent and requirement, we’ll be updating our product to stay current where applicable. 

Real-World Consequences: When Cookie Compliance Goes Wrong

Consider the case of Sephora, the multinational beauty retailer. In August 2022, Sephora agreed to pay a $1.2 million settlement for CCPA violations related to their cookie practices. The company failed to properly disclose to consumers that they were selling their personal information and didn’t process opt-out requests.

Or take British Airways, which faced a staggering $22 million GDPR fine partly due to inadequate cookie consent mechanisms that led to a data breach affecting over 400,000 customers.

These aren’t isolated incidents. They represent a growing trend of regulatory authorities cracking down on non-compliant websites.

You May Know About California’s CCPA Policy,
But Do You Know Other States Have Laws Too and More Are Coming

Key Sections Related to Consent


§ 1798.120 – Right to opt out of sale or sharing of personal information:
Businesses must provide notice of right to opt out.
Must respect consumer’s decision to opt out
Cannot request opt-in consent for 12 months after opt-out
§ 1798.121 – Right to limit use and disclosure of sensitive personal information.
§ 1798.125 – Prohibits discrimination for exercising CCPA rights.
§ 1798.130 – Methods for submitting consumer requests and business response requirements.
§ 1798.135 – Requirements for “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information” links.
§ 1798.140 – Definitions section defining “consent” as “any freely given, specific, informed, and unambiguous indication of the consumer’s wishes… such as by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose.”
§ 1798.145(a) – General exceptions to the CCPA.
§ 1798.150 – Private right of action for data breaches.
§ 1798.155 – Administrative enforcement by the California Privacy Protection Agency.
§ 1798.175 – Intent to further the constitutional right of privacy and supplement existing laws.

Core Legislation

Regulation (EU) 2016/679 – The General Data Protection Regulation is the primary legislation establishing EU-wide rules for data protection.

Key Articles Related to Consent
Article 4(11) – Defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”
Article 6(1)(a) – Establishes consent as one of the lawful bases for processing personal data.
Article 7 – Sets conditions for consent:
Controller must demonstrate consent was given
Consent requests must be clearly distinguishable from other matters
Right to withdraw consent at any time
Assessment of whether consent is freely given
Article 8 – Establishes special conditions for children’s consent (16 years, though Member States may lower to 13).
Article 13 & 14 – Information to be provided when collecting personal data (transparency requirements).
Recital 32 – Clarifies that consent should be given by “clear affirmative act” and that “silence, pre-ticked boxes or inactivity” does not constitute consent.

TikTok — $5.4 million

In January 2023, France’s data protection watchdog, CNIL, fined TikTok €5 million ($5.4 million) for making it difficult to refuse cookies on its website. The CNIL found that TikTok manipulated consent by discouraging users from rejecting cookies. They required multiple clicks to refuse cookies, but only one click to accept them. TikTok resolved the issue by adding a “Refuse all” button to its site. 

The CNIL also found that TikTok did not adequately inform users about the purpose of cookies. These actions are part of France’s enforcement of cookie consent requirements, which aim to address tracking practices without proper consent. While the enforcement is limited to France, it may have broader implications for companies operating in the EU. TikTok stated that they have addressed the issues and will be prioritizing user privacy in the future.

Microsoft -$65 Million

On December 22, 2022, Microsoft Ireland was fined €60 million ($65 million) by CNIL for not providing an easy option to refuse cookies on bing.com. CNIL’s investigations found cookies being used for advertising purposes without user consent. 
The fine was based on the extent of data processing, affected users, and profits generated from the data collected using these cookies. 
Microsoft was ordered to obtain consent from French users before depositing advertising cookies, with a daily penalty of €60,000 for non-compliance. CNIL determined that the company breached Article 82 of the French Data Protection Act by depositing cookies without consent and by not providing a compliant means of collecting consent. 

Sephora — $1.2 million

In August 2022, Sephora, a prominent beauty retailer, became the first company publicly fined for violating California’s Consumer Privacy Act (CCPA). California Attorney General announced a settlement with Sephora to address the alleged CCPA violations, which include:
Using data tracking technologies such as cookies that sent consumers’ data to external ad tech and analytics companies without properly informing or offering an opt-out choice to consumers. The CCPA requires businesses to either set up contracts with vendors to ensure compliant data handling or offer consumers a means to opt out, but Sephora did neither. 
Failing to process consumer opt-out requests made through universal privacy controls like the Global Privacy Control (GPC). Failing to take corrective action within the 30-day cure period allowed by the CCPA for businesses to address violations. (The right to cure violations under the CCPA is no longer available with the implementation of the CPRA)
As a result, Sephora was fined $1.2 million and ordered to meet the following terms:
Revise online disclosures and privacy policy to explicitly state their personal information selling practices.

Google — $162 million

On December 31, 2021, Google was fined a total of €150 million ($162 million) by the CNIL for not providing an easy way for users on google.fr and youtube.com to refuse cookies compared to accepting them.
CNIL conducted an investigation after receiving complaints and found that while Google offered a one-click option to accept cookies, there was no similarly user-friendly solution to reject them. This discrepancy violated users’ freedom of consent and discouraged cookie refusal.
The fines, €90 million ($97 million) for Google LLC and €60 million ($65 million) for Google Ireland Limited, were justified based on the number of affected users and the significant profits derived from advertising revenue tied to collected data. In addition to the fines, CNIL issued an injunction requiring Google to provide a simplified means for French internet users to refuse cookies within three months, with daily penalty payments for non-compliance.

Facebook — $65 million

On December 31, 2021, Facebook Ireland Limited was fined €60 million ($65 million) by the CNIL for making it difficult for users in France to refuse cookies on Facebook.com. The CNIL received complaints and found that accepting cookies was easy with a single click while rejecting them required multiple clicks and was less prominent. This complex process discouraged users from refusing cookies, violating their freedom of consent.
The restricted committee also found Facebook’s information unclear as users had to click on a button labeled “Accept cookies” to refuse them, causing confusion.
They judged these methods and lack of clarity to be violations of Article 82 of the French Data Protection Act. Like Google, CNIL gave Facebook a three-month deadline to simplify the cookie refusal process or face a daily penalty of €100,000. Similarly, the GDPR “one-stop shop” mechanism did not apply here as well.

Amazon — $38 million

On December 7, 2020, the French data protection authority, CNIL, sanctioned Amazon Europe Core a fine of €35 million ($38 million). The company placed advertising cookies on users’ computers without obtaining consent or providing sufficient information on the Amazon.fr sales site.
CNIL found two violations of the Data Protection Act:
It automatically placed numerous advertising cookies on users’ computers without their consent, which was not essential for the service. This failure to obtain consent violated the obligation to seek user consent before depositing cookies.
The banner displayed on the Amazon.fr site did not adequately inform French users about the cookies. It lacked clear information about the cookies objectives and how to refuse them.
Moreover, when users visited Amazon.fr after clicking on an advertisement on another website, the same cookies were placed on the user’s devices without displaying any banner, which was another violation.
This incident emphasizes the importance of obtaining explicit user consent and providing transparent information about cookies, especially for advertising purposes.

Carrefour — $3.23 million

In November 2020, the CNIL fined Carrefour, a retail and wholesaling corporation, a total of €3 million ($32.3 million) following inspections at Carrefour France and Carrefour Banque. The CNIL discovered multiple GDPR violations, including a breach of cookie consent.
Regarding cookies, the CNIL found that both the carrefour.fr and carrefour-banque.fr websites placed cookies on users’ devices without obtaining their consent.
Some of these cookies were used for advertising purposes, requiring prior consent. The companies modified their website functionalities during the procedure to ensure that advertising cookies are no longer placed without user consent.
Carrefour also violated GDPR requirements in other areas, such as inadequate information provision, excessive data retention, unjustified identity verification, failure to respond to requests, and transmit more data than disclosed.
The company made changes to address these issues during the procedure. Consequently, Carrefour France was fined €2.25 million ($2.42 million), and Carrefour Banque received a penalty of €800,000 ($861,868). Despite the infringements, no compliance injunction was issued due to the significant efforts made to rectify the issues.

Twitter – $32,320

On June 9, 2020, the Spanish Data Protection Agency (AEPD) imposed a €30,000 ($32,320) fine on Twitter for alleged non-compliance with Law 34/2002 on information society services and electronic commerce. The complaint raised concerns about Twitter’s insufficient disclosure of cookie information and lack of clarity regarding the involvement of third-party partners. The investigation revealed that Twitter automatically stored various cookies on its website for analytics, customization, and advertising purposes. Despite being notified of the proceedings, Twitter did not provide a response. The utilization of non-essential cookies without clear information or options for users to opt out or manage them was considered a violation of the law. Consequently, the fine was imposed, taking into account the intentional nature of the violation and other relevant criteria.

Twitter’s fine is relatively small compared to fines imposed on other companies and even its own revenue. This holds true for many companies, as they often earn much more annually than the fines they receive. However, it still serves as a crucial reminder not to underestimate the importance of cookie consent laws. Non-compliance can have severe consequences, particularly for small businesses.

Other United States Laws

Other International Laws

Brazil:
Lei Geral de Proteção de Dados (LGPD)

  • Similar structure to GDPR
  • Requires clear, unambiguous consent
  • Administrative sanctions up to 2% of revenue in Brazil (cap of R$50 million per violation)

Japan:
Act on the Protection of Personal Information (APPI)

  • Updated significantly in 2020
  • Requires consent for data transfers to third parties
  • Special care for sensitive data (“special care-required personal information”)

Canada:
PIPEDA and CPPA

  • PIPEDA currently in force; CPPA is its proposed replacement
  • Knowledge and consent required for collection, use, or disclosure of personal information
  • Meaningful consent standard emphasized

South Korea:
Personal Information Protection Act (PIPA)

  • One of the strictest privacy regimes globally
  • Requires explicit consent for collection and use of personal information
  • Separate consent required for different purposes

Thailand:
Personal Data Protection Act (PDPA)

  • Effective June 2022
  • Explicit consent required for collection of personal data
  • Penalties up to THB 5 million

Singapore:
Personal Data Protection Act (PDPA)

  • Consent obligation is cornerstone
  • Deemed consent provisions
  • Financial penalties up to 10% of annual turnover or SGD 1 million

Everything you need for complete compliance

Our platform provides an all-in-one solution for managing consent, enhancing privacy,
and maintaining compliance across all your digital properties.

Global Compliance

Automatically comply with GDPR, CCPA, ePrivacy and other global privacy regulations with our constantly updated solution.

Beautiful Design

Fully customizable consent notices that match your brand’s look and feel, with elegant animations and responsive layouts.

Multi-language Support

Auto-detect visitor language and display consent notices in over 50 languages with our built-in localization system.

Performance Optimized

Lightweight implementation with minimal impact on your website’s loading speed and performance metrics.

Easy To Implement

Simply copy our easy to use snippet and go to your website and paste it in you header and that’s it. In a few seconds you are ready to go.

Intuitive Dashboard

Manage all your websites from one central dashboard with real-time analytics and compliance reporting

Simple And Transparent Pricing

Agency Professional

$697.00 lifetime

  • Unlimited Websites
  • Unlimited Views
  • Dedicated Support
  • Basic Analytics
  • Email Support
Call To Action