What Happens if a Website Ignores GDPR Requirements

The EU's General Data Protection Regulation applies to any website that handles personal data of people in the EU, wherever the site is based. When a site ignores it, the consequences range from a warning to very large fines, though enforcement is uneven.

How violations come to light

• Complaints from users to a national data protection authority.
• Campaigns by privacy groups, such as noyb, which have filed complaints about hundreds of cookie banners at a time.
• Data breaches, which companies must report to regulators.
• Investigations regulators start on their own, often into whole sectors.

What regulators can do

• Issue warnings and reprimands.
• Order a company to change how it handles data, or to stop processing it.
• Fine up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.

Small websites usually get orders to fix problems before any fine. The biggest fines go to large companies.

Real examples

• Meta: fined €1.2 billion by Ireland's regulator in 2023 over transfers of EU users' data to the US.
• Cookie banners: in January 2022, France's regulator, the CNIL, fined Google €150 million and Facebook €60 million because refusing cookies was harder than accepting them.
• Amazon: fined €746 million by Luxembourg's regulator in 2021 over its ad targeting.

Other consequences

• Lawsuits: people can claim compensation for harm caused by a breach of GDPR.
• Reputation: fines and breaches make news.
• Blocked services: regulators can order a service to stop processing data, which can shut down features in the EU.

Common violations on websites

• Setting tracking cookies before you agree.
• No "Reject all" option as easy as "Accept all".
• Pre-ticked consent boxes, or legitimate interest switched on by default. See legitimate interest explained.
• Ignoring requests to see or delete your data.

What you can do

1. Use your rights: ask a company for a copy of your data or to delete it. It generally has a month to respond.
2. Complain: if it ignores you, file a complaint with your country's data protection authority, usually online and free.
3. Reject tracking: Cookie Auto-Reject clicks "Reject all" on many banners for you.

See also whether cookie walls are legal. This is general information, not legal advice.