The verdict in three sentences
A formal notice from a data protection authority about cookies is not a fine, but a compliance deadline, usually one to three months, that you must meet. For a Berlin B2B services company, the audit, consent platform and form rework add up to EUR 2,500 to 8,000 excluding VAT, delivered in 2 to 4 weeks. That is nothing compared with recent sanctions, which range from tens of thousands to several million euros.
What regulators object to most often
The CFO who receives the letter often learns that the site sets advertising or analytics trackers as soon as a visitor arrives, before any click. In Germany, the TDDDG (formerly TTDSG) and the GDPR apply together, and the Berlin authority follows the same logic as other EU regulators. The recurring failures in 2025 and 2026 are well known.
| Frequent failure | Concrete example | Expected fix |
|---|---|---|
| Trackers set before consent | Meta Pixel, Google Ads, LinkedIn Insight loaded on first view | Blocked until the user accepts |
| Refusing harder than accepting | "Accept all" visible, refusal hidden in settings | "Reject all" button at the same level |
| Undocumented consent | No timestamped proof of the choice | Consent log retained |
| Excessive lifetime | Cookies valid 25 months or more | 13 months maximum, renewal at 6 months advised |
| Incomplete notices | No list of purposes or recipients | Updated cookie policy and privacy page |
| Data-hungry forms | Date of birth required for a quote request | Field minimization, clear purpose |
One piece of good news: some audience measurement can be configured in a privacy-friendly, cookieless or anonymized mode, which preserves your basic statistics.
What compliance costs in 2026
Here are the ranges observed for a services company site of 30 to 150 pages, with contact and quote forms.
| Service | 2026 range (excl. VAT) | Timeline |
|---|---|---|
| Cookie and tracker audit (scan, analysis, report) | EUR 1,500 to 4,000 | 3 to 7 days |
| Consent management platform (CMP) | EUR 0 to 150/month | Setup in 1 to 3 days |
| CMP integration and script blocking via tag manager | EUR 800 to 2,000 | 3 to 5 days |
| Rework of forms and legal notices (Impressum, privacy) | EUR 1,000 to 3,000 | 1 to 2 weeks |
| Record of processing activities for the site | EUR 500 to 1,500 | 2 to 4 days |
| Written reply to the authority with evidence | EUR 500 to 1,200 | 2 to 3 days |
| Quarterly tracker check | EUR 150 to 400/quarter | Recurring |
A free CMP is enough for a modest site. Paid plans become worthwhile above 50,000 visits a month, for multilingual sites, or when marketing needs Google's advanced consent mode to limit conversion data loss.
Mini case study
Katrin, CFO of a 60-employee HR consulting firm in Berlin, receives a notice giving her two months. The audit (EUR 2,800) finds 14 trackers, 6 of them advertising tags loaded without consent. A CMP at EUR 60/month (EUR 1,500 setup), rework of 4 forms and notices (EUR 1,800) and the reply to the authority (EUR 800) bring the total to EUR 6,900, plus EUR 720 a year in subscription. After the fix, the acceptance rate settles at 58%: marketing loses some ad data, but the company closes the case in 3 weeks, well before the deadline.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is a formal notice made public?
It can be if the authority decides so, which is rare. If the company complies within the deadline, usually one to three months, the case is closed without sanction.
What is the maximum GDPR fine?
Up to EUR 20 million or 4% of global turnover. On cookies, EU regulators have already fined large platforms tens of millions of euros, and mid-sized companies EUR 10,000 to 500,000.
Do we need a DPO to fix cookies?
In Germany, a DPO is required once 20 or more people regularly process personal data, which a 60-person firm often reaches. The DPO can be external, from about EUR 150 to 500 a month.
Is Google Analytics banned?
No, but it requires prior consent. A privacy-friendly analytics tool lets you keep close to 100% of basic audience measurement.
How long should consent records be kept?
The recommended practice is to keep the log for the validity of the choice, 6 to 13 months, plus the time needed to answer an inspection.
Let's scope your project. Send us your site URL and, if applicable, the authority's letter: we will price the audit, CMP and form rework with a schedule that meets your deadline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
