The common thread is a gap no banner closes on its own: nobody verified that the tags obeyed the choice.

There is a specific category of privacy fine that has nothing to do with missing paperwork. The company had a consent banner. It had opt-out language. In several of these cases, it had a paid consent management platform. It was fined regardless, because the mechanism it presented to users did not actually govern what happened on the page. The head of enforcement at the California Privacy Protection Agency put it without hedging when the agency fined Todd Snyder: using a consent management platform does not get a business off the hook for compliance.

Five enforcement actions from 2025, three in California and two in France, describe the same failure from five angles. Read together, they specify precisely where a consent programme breaks, and what a control would have to do to catch it.

The Five Cases

SHEIN - €150 million, CNIL (France), September 2025

Advertising cookies were written the instant a user reached shein.com, before the banner was displayed. When a user clicked “Reject all,” or later withdrew consent, new cookies were still placed and existing ones continued to be read. The banner was present and the reject button was present; neither governed the tags. The decision fell under Article 82 of the French Data Protection Act, so the GDPR one-stop-shop did not apply, and the CNIL held direct jurisdiction over an Irish-domiciled subsidiary.

Google - €325 million, CNIL (France), September 2025

Announced the same week. Advertising cookies were tied to account creation without valid consent, through an interface where refusing required more steps than accepting. Part of the CNIL’s reasoning was that the consent was not “freely given” - a phrase that marks the exact boundary of what any automated tool can and cannot check.

Healthline - $1.55 million, California Attorney General, July 2025

The largest CCPA settlement to date. Healthline’s banner offered a checkbox to disable “Targeting / Advertising cookies.” Unchecking it did nothing; the tracking kept running. Investigators performed a “triple opt-out” - the footer “Do Not Sell or Share” link, the cookie banner, and Global Privacy Control - and still observed third-party advertising cookies firing and identifiers transmitting, including data revealing the titles of health articles a reader had viewed. The opt-out mechanisms had never been effectively tested. The banner was not absent; it was decorative.

Todd Snyder - $345,178, CPPA (California), May 2025

For a 40-day window, the “Cookie Preferences Center” banner appeared and then instantly vanished, making an opt-out impossible to submit. The same misconfiguration meant the site never recognised GPC signals. The CPPA’s finding was blunt: the company deferred to third-party privacy tools without knowing their limitations or validating their operation.

Honda - $632,500, CPPA (California), March 2025

The consent interface let a user accept all cookies in one click but required toggling categories individually and confirming in order to opt out - an asymmetry the CPPA treated as a dark pattern. Honda also failed to apply GPC-based opt-outs to known account holders. Here the banner functioned; its design unfairly weighted the choice.

What Actually Connects Them

Stripped to their mechanics, the category is sharp. In none of these cases was the violation “you had no consent mechanism.” In every one, the violation was that the mechanism did not do what it represented:

SHEIN and Todd Snyder: the tag fired before, or regardless of, the choice.
Healthline: the control was shown but wired to nothing, and never tested.
Google and Honda: the choice was offered but structurally skewed toward consent.

Two failure modes sit underneath. Most of these are runtime failures - a discrepancy between what the banner claimed and what the page did when it loaded, visible only by observing the live page, not by inspecting the configuration. Google and Honda add a second mode: a design-fairness failure, where the mechanism worked mechanically but was weighted unfairly. That distinction determines what any tool can honestly claim against this category.

The through-line the regulators themselves keep stating is simple. A banner is a representation; enforcement is measured against behaviour. The gap between the two is where every one of these fines landed, because nobody was continuously checking whether the running system matched the promise on the banner.

Where Scrutora Fits, and Exactly How Far

Scrutora’s consent capability is built to close that gap. Which parts of these cases it addresses, and which it does not, is worth stating precisely, because the boundary is the point.

The runtime tag monitor is the directly relevant capability. It loads the live page and records what actually fires in three states: before any consent, on “Reject All,” and on “Accept All.” This maps onto the mechanical core of four of the five cases. A tag firing before consent is SHEIN. A reject that leaves tags running is Healthline, and the “reject all” failure in SHEIN. A banner that appears and vanishes without wiring the opt-out is the observable symptom Todd Snyder exhibited. Because the monitor watches behaviour rather than configuration, it catches tags managed in a tag-manager console that never appear in the codebase - which is where these misconfigurations usually live, outside engineering’s view.

Consent-coverage adds the correlation. Scrutora scores whether the purposes a site has configured actually cover the personal data it detects, so a category being collected or transmitted with no corresponding active purpose is surfaced rather than assumed away. This is the structural check behind “the banner said users could opt out of advertising cookies, but advertising data left anyway.”

The code scanner supplies the PII ground truth underneath both - and its role in this category is supporting, not leading. Scrutora’s taint engine detects regulated data in the codebase - PII, PHI, payment data, and country-specific identifiers - and traces each category from where it enters to where it is logged, stored, or sent to a third party. For the consent failures in this article, that detection is not the capability that catches the fine; these five were caught by observing the live page, and a runtime monitor alone would surface most of them. What the code scanner adds is precision on the other two questions consent-coverage depends on: what sensitive category is actually in a given flow, and which framework obligation it triggers. It answers “the tag that fired is carrying an email and a health-related identifier, classified from the source, and here is the clause that governs it,” rather than “a tag fired.” In a pure cookie-banner failure that classification is a strengthening detail. In a case where the leaking field is a national identifier or health data - a different class of enforcement, exemplified by the Swedish pharmacy Meta Pixel fines under Article 32 rather than the consent rules - that same code-level classification becomes the load-bearing capability, because a value hashed or renamed on the wire cannot be classified by watching the page alone. For the five consent cases here, treat the code scanner as the layer that makes a finding specific and citable, not the layer that detects the failure.

The immutable, hash-chained records and ISO 29184 receipts address the evidentiary half - proving, later, what a given user was shown and chose. Several of these settlements imposed multi-year obligations to document and report opt-out processing; that is precisely the artifact these records produce.

Taken together, Scrutora’s honest claim against this category is specific: it removes the mechanical failure at the centre of SHEIN, Healthline, and Todd Snyder - the tag that fires against the user’s choice, unnoticed - by verifying behaviour at runtime instead of trusting the banner’s configuration, and it produces the evidence trail the settlements demand. That is a real answer to most of this list, and more than a page-watching tracker scanner offers on its own, because the runtime observation is tied to the data categories the code scan classifies and to the specific clause each finding breaches.

The Boundary, Stated Without Softening

Scrutora can verify that a tag fired or did not fire against a recorded consent state. It cannot rule on whether the consent was legally valid. The Google fine turned partly on consent not being “freely given,” and the Honda fine on an interface that was mechanically functional but unfairly weighted. Those are judgments about the fairness and design of a choice, not about whether software obeyed a signal. No runtime monitor determines that refusing was made unlawfully harder than accepting, or that a purpose was described misleadingly. That assessment belongs to a DPO or counsel.

Against this list, the split is clean. Scrutora directly attacks the mechanical failures in SHEIN, Healthline, and Todd Snyder. It provides partial, evidentiary support against Google and Honda - it can show what fired and when, which informs the analysis - but it does not make the “freely given” or “dark pattern” determination those two ultimately rested on. Any tool claimed to eliminate the entire category is being oversold.

That boundary is not a hedge; it is the reason the rest of the claim holds. The mechanical failure - a tag betraying the user’s choice while no one watches - is a solvable engineering problem, and it produced the largest and most numerous fines in this set. Solve it continuously, on every deployment, produce the evidence that it was solved, and the gap these five companies fell into is closed. The legal-fairness judgment sits above it, where it always has, and where it should stay.

Sources

Each case links to the supervisory authority’s own decision or press release.

SHEIN - €150M, CNIL (France), 1 September 2025. Deliberation SAN-2025-005; Article 82 of the French Data Protection Act. Cookies placed before the banner; “Reject all” and withdrawal ineffective; third parties undisclosed. cnil.fr
Google - €325M, CNIL (France), 3 September 2025. €200M against Google LLC and €125M against Google Ireland Ltd. Advertising cookies placed on account creation without valid consent; ads inserted between Gmail messages; consent held not “freely given.” Announced under the same CNIL cookie action plan as the SHEIN decision. cnil.fr
Healthline Media LLC - $1.55M, California Attorney General, 1 July 2025. Largest CCPA settlement to date. After a “triple opt-out” (footer link, cookie banner, and Global Privacy Control), third-party advertising cookies still fired and identifiers still transmitted; opt-out mechanisms were never effectively tested. oag.ca.gov
Todd Snyder, Inc. - $345,178, CPPA (California), 6 May 2025. For a 40-day period the Cookie Preferences Center banner appeared and instantly vanished, blocking opt-out and defeating GPC recognition; the company had not validated its consent tool’s operation. Press release - Full order (PDF)
American Honda Motor Co. - $632,500, CPPA (California), 12 March 2025. Asymmetric consent design (one-click accept vs. multi-step reject) treated as a dark pattern; GPC opt-outs not applied to known account holders; missing CCPA contract terms with adtech vendors. cppa.ca.gov

Figures and findings per the supervisory authorities’ published statements. Primary decision documents are the authoritative citation where available; press releases are linked otherwise.

Vimalendukumar Dwivedi is Co-founder of Scrutora, a Code Compliance Platform.

Five Consent Banners That Worked Exactly as Designed, and Cost Their Owners a Fine Anyway