Monthly Update – October 2025
While AI, the European Data Act, and international data transfers have dominated headlines, regulators have quietly been sharpening their focus on privacy fundamentals. October confirmed it: the basics are back in the spotlight, and businesses are expected to keep up.
Two developments stood out this month:
Cookie banners: broken by design, and Brussels is working on it
Coming in 2026: a coordinated GDPR enforcement sweep on transparency
1. Cookie banners are broken, and Brussels is working on it
What happened:
If you have ever felt like you needed to click through a maze of "Reject All" buttons just to read an article, you are not alone.
EU lawmakers agree: cookie consent banners have become overly complicated, confusing, and frustrating for users. Enforcement has been picking up significantly. In September 2025, the French DPA (CNIL) fined Google €325 million and Shein €150 million in a single day, both for cookie violations. The Dutch DPA issued formal warnings to over 200 websites and fined a Dutch retailer €600,000 for pre-ticked consent boxes.
On the reform side: the Commission's long-running attempt to replace the ePrivacy Directive with a new ePrivacy Regulation was formally withdrawn in February 2025. Cookie rules are now expected to be addressed as part of the broader Digital Omnibus reform package, with the Commission proposing browser-level consent as a way to reduce banner fatigue. That proposal is still working its way through the legislative process.
In the meantime, current rules remain in force and regulators are actively enforcing them.
What this means for you:
The direction of travel is clear, even if the final rules are not yet adopted:
Make "Reject All" just as prominent and easy to click as "Accept All." Banners that deprioritise rejection are a known enforcement target.
Remove pre-ticked boxes and manipulative wording. These are the fastest route to a fine.
Block tracking scripts until after consent is given.
Keep a record of all user consents for audit purposes.
If you want to understand how a well-set-up cookie banner can actually work in your favour rather than just tick a compliance box, see our earlier post: Your Cookie Banner as a Business Asset.
2. The EDPB's 2026 enforcement sweep will target transparency
What happened:
At its October 2025 plenary, the European Data Protection Board announced that its 2026 Coordinated Enforcement Framework (CEF) action would focus on transparency and information obligations under Articles 12, 13, and 14 of the GDPR.
In practice, this means 25 data protection authorities across Europe are jointly examining whether businesses are giving individuals clear, complete, and accessible information about how their personal data is processed. This enforcement action is already underway as of early 2026.
Previous CEF actions have targeted cloud use in the public sector, Data Protection Officers, the right of access, and the right to erasure. Transparency is the natural next step: it underpins all of the above.
What this means for you:
Regulators are not just looking at whether a privacy notice exists. They are checking whether it is genuinely understandable. Ask yourself the following:
Privacy notices: Are they clear, current, and accessible to the average reader?
Legal bases: Is each use of data properly justified and documented?
Rights management: Are subject access and correction requests handled consistently and on time?
Third-party sharing: Is it disclosed and documented?
Indirect data collection: If you collect data about individuals from other sources (such as referral partners, data brokers, or analytics vendors), does your privacy notice cover it under Article 14?
Internal documentation: Are you ready for an audit?
Put yourself in the shoes of your user, customer, or website visitor. After reading your privacy notice, can they genuinely understand what you are doing with their personal data? If the honest answer is no, now is the time to fix it.
That's a wrap!
Two updates, one clear message: privacy fundamentals are a top enforcement priority. The EDPB is actively coordinating investigations on transparency across 25 countries, and cookie banners are drawing real fines. Neither of these is a future risk to monitor. Both are live.
Not sure whether your current practices hold up to scrutiny? We can help. Book a consultation or reach out with your question directly.
We take great care in providing information to you, but please be aware of the fact that these blogposts can not be considered a substitute for professional legal advice, nor do they create an attorney-client relationship.