The verdict in three sentences
Cookies and consent are the first target of regulator checks because they are visible from the browser: no on-site inspection needed. In 2026, a GDPR audit costs 1,500 to 4,000 EUR, a CMP (consent management platform) 0 to 200 EUR/month, and compliance wraps up in 3 to 5 weeks. The real stake is avoiding a fine of up to 4 % of turnover.
What GDPR compliance costs in 2026
Compliance combines one-off work (audit, register, banner) and recurring costs (CMP, DPO). For a B2B SME, the initial investment stays modest against the risk incurred.
| Item | 2026 range (EUR) | Type |
|---|---|---|
| GDPR audit | 1,500 - 4,000 | one-off |
| Processing register | included in audit | one-off |
| CMP (consent banner) | 0 - 200 / month | recurring |
| Banner rework + config | 500 - 1,500 | one-off |
| Privacy policy | 400 - 900 | one-off |
| Outsourced DPO (option) | 400 - 1,200 / month | recurring |
A compliant banner: the non-negotiable rules
Regulators require that refusing be as easy as accepting. A banner offering only "Accept all", or dropping cookies before the choice, is in breach. Consent must be free, informed, specific and provable.
| Rule | Compliant | Non-compliant |
|---|---|---|
| Reject button visible | yes, same level | "accept" only |
| Cookies before consent | no non-essential | dropped upfront |
| Proof of consent | timestamped, kept | absent |
| Consent duration | 6 - 13 months max | unlimited |
| Withdrawal as easy | yes, 1 click | hidden |
| Third-party cookies listed | yes, by purpose | opaque |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Karim, head of a B2B services SME in Amsterdam, turns over 3.2M EUR and uses Google Analytics, a chat widget and ad pixels without compliant consent. A complaint could trigger a check. He orders a GDPR audit at 2,800 EUR, deploys a CMP at 90 EUR/month and reworks his banner (900 EUR). First-year investment: 2,800 + 900 + 1,080 = 4,780 EUR. Against a theoretical fine exceeding 100,000 EUR (4 % of turnover), compliance is insurance at marginal cost.
FAQ
Is Google Analytics still allowed? Yes, but only after consent and with proper configuration. Dropping the cookie before the user's choice is a breach.
Is a free CMP enough? For a simple site, yes. As traffic or integrations grow, a paid CMP (up to 200 EUR/month) offers more guarantees and reporting.
How long to become compliant? Usually 3 to 5 weeks: audit, register, banner rework, privacy policy and CMP configuration.
Is the processing register mandatory? Yes, whenever you regularly process personal data. It must be kept up to date and presentable during a check.
Is a fine really likely? The cap is 4 % of worldwide turnover. Frequent sanctions mostly target non-compliant cookies, which are easy to observe remotely.
Let's scope your project. A B2B site to bring into GDPR, cookie and consent compliance before a regulator check? Tell us your tracking tools and turnover. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
