GDPR fines in 2026: what the latest decisions mean for your website
GDPR fines in 2026: why Orange lost its appeal over cookies, what Google was fined for in Ireland, and what the CNIL fines small websites for.
The Casebook
Website compliance, in plain English
Plain guides to the rules your website is read against, one case at a time.
Digital omnibus: what the Council's text changes for cookie banners
The digital omnibus has a Council text since 21 October 2026. What it changes for cookie banners, one-click refusal and analytics, and what comes next.
Read the caseEarlier in the casebook
YouTube nocookie: what privacy-enhanced mode does, and what it doesn't
YouTube nocookie embeds explained: what privacy-enhanced mode changes, what still loads before and after Play, and how to hold videos until consent.
Subscription traps: what the UK's new rules ask of your sign-up page
The UK's subscription traps rules are due on 1 January 2027. What the draft regulations ask of your sign-up page, reminders and cancel route, in plain words.
CMA fines: fake deals, pre-ticked extras and a hidden joining fee
CMA fines under the DMCC Act: why Wayfair, Appliances Direct and Gold's Gym were fined in October 2026, and how to check your own deals and checkout.
Video Privacy Protection Act: why sites with videos and a pixel get sued
The Video Privacy Protection Act is an old video rental law now used against sites with video and a Meta pixel. What courts ruled, and what comes next.
CIPA lawsuit: what courts decided about pixels, chat and session replay
A CIPA lawsuit targets pixels, chat widgets and session replay on your site. What courts have ruled, what SB 690 ends, and what is still open.
SB 690: what California's CIPA change means for your website
SB 690 ends private pen register suits over website trackers from 1 January 2027. What changes, which CIPA claims remain, and what to check on your site.
CCPA fines in 2026: the opt-out cases behind them
CCPA fines in 2026: what Disney, Ford, PlayOn and GM paid for, why most cases turn on opt-outs, and how to test your own Do Not Sell or Share link.
Hims and Hers lawsuit: the FTC's case on pixels, billing and cancelling
The Hims and Hers lawsuit for site owners: what the FTC alleges about tracking pixels, charging after a form and cancelling, and how to check your site.
Pseudonymised data: is it still personal data after EDPS v SRB?
Pseudonymised data can be personal data for you and not for the company you send it to. What the EU court decided, and what it means for hashed emails.
How to remove a Google review, and what you're not allowed to do
How to remove a Google review as a business owner: what Google takes down, how to report and appeal, and the review rules your own site has to follow.
Data processing agreement: what it is and which of your tools need one
A data processing agreement in plain words: what Article 28 asks, which website tools need one, where vendors keep theirs, and how to check your own.
Security headers: what they do and how to add them to your site
Security headers for site owners: HSTS, CSP, X-Frame-Options and the rest, where to set them on your host, and how to check yours in a minute.
ADA compliance checklist for a small business website
An ADA compliance checklist for a small business website, built on WCAG 2.1 AA: alt text, keyboard use, contrast, focus, forms, captions and headings.
Website accessibility lawsuits: what they look like for a small business
Website accessibility lawsuits, explained for a small business: how a demand letter reads, why overlays didn't stop them, and a phone check for your site.
CCPA compliance checklist for your website
CCPA compliance for a website in one checklist: thresholds, the Do Not Sell or Share link, Global Privacy Control, the notice at collection and the policy.
GDPR compliance checklist for your website: 15 things a visitor can see
A GDPR compliance checklist for a company website: the 15 things a visitor's browser can see, from cookies and consent to rights routes and trader details.
Junk fees: what the US rules ask of your checkout
Junk fees in the US: the FTC fees rule, the FTC's 2026 cases, the state laws from California to Colorado, and a five-minute check of your own checkout.
Types of cookies on websites and which ones wait for a yes
Session, persistent, first and third party, strictly necessary, functional, analytics, marketing: the types of cookies on websites and which need consent.
Dark patterns examples: eight tricks and the cases that named them
Dark patterns examples with a named enforcement case for each: confirmshaming, roach motel, fake countdowns, drip pricing, pre-ticked boxes and more.
Incentivized reviews: what's allowed and what isn't
Incentivized reviews, review gating and bought reviews under the FTC rule, the UK DMCC Act and the EU Omnibus rule, and a check of your own reviews page.
What is personal data? Examples from an ordinary website
What is personal data? GDPR and UK GDPR examples from a real website: IP addresses, cookie IDs, form fields, support emails, and what your notice lists.
Privacy policy example for a small company website, section by section
A privacy policy example you can read in five minutes: sample wording for each section, plus what EU, UK and US rules add. Written for a small company.
Right to be forgotten: what it means for a small company's website
The right to be forgotten lets people ask you to delete their data. When it applies, when it doesn't, and what your website should say about it.
Tracking pixel: what it is and how to spot one on your site
A tracking pixel is a tiny image or script that reports a visit to an outside server. What it collects, what regulators did about it, and a phone check.
What is a DSAR and what to do when one arrives
A DSAR is a request for a copy of someone's personal data. What it covers, the one-month clock, what to leave out, and how to set up a route on your site.
How to check website cookies on your own site, with no tool
How to check website cookies and tracking requests on your own site with a phone or your browser, and what to look for before and after the banner.
Cookie consent examples: banners that work and banners regulators flagged
Cookie consent examples in words: equal buttons, pre-ticked boxes, cookie walls and legitimate interest toggles, with what EU and UK regulators said.
Is cookie consent required in the USA? What to show instead of a banner
Is cookie consent required in the USA? Mostly no banner, but California asks for an opt-out link and a working Global Privacy Control. Here's what to show.
Cookie policy template: what to say, section by section
A cookie policy template you fill in from your own site: each cookie or tool, its purpose, how long it lasts, who sets it and how to switch it off.
Google Analytics and GDPR: what the regulators decided, and what to do now
Google Analytics GDPR, from the regulators: the 2022 Austrian, French and Italian decisions, the 2023 Data Privacy Framework, and what to do now.
Google consent mode v2: what it does, and what it leaves to you
Google consent mode v2 in plain words: basic versus advanced, what it changes in Google's tags, what it leaves to you, and a phone check for your own site.
Opt in vs opt out: what each means for your emails and your trackers
Opt in vs opt out, explained for a small company: GDPR consent, the UK soft opt-in under PECR, CAN-SPAM's opt-out, and a phone check for your own forms.
Drip pricing: what it is and how to show your full price
Drip pricing adds mandatory fees late in checkout. See what the UK and US rules say, two 2026 CMA decisions, and a five-minute check for your own site.