GDPR Cookie Consent in 2026: ePrivacy, Legitimate Interest, and What Actually Compliant Looks Like
The ePrivacy Regulation was withdrawn in February 2025. The CNIL fined Google €325M and Shein €150M in September 2025. The EDPB expanded the scope of Article 5(3) to pixels and fingerprinting. A practitioner's guide to GDPR cookie consent in 2026, grounded in the regulation text, the CJEU case law, and the enforcement actions that define the line.
