Cookies on Websites: Obligations, Fines, and the Cost of a Proper Solution

The owner of an online accessories store receives an email from the Office for Personal Data Protection. Someone filed a complaint about her website: although the cookie banner appears immediately upon entering the site, the „Reject“ button is missing. The only options are „I Agree“ or clicking through to the settings, which no one looks for.

A developer set up the sidebar three years ago when the website launched, and no one has touched it since—just like many other aspects of website maintenance. In the meantime, however, the rules haven’t just changed on paper—they’ve also begun to be enforced in practice.

The solution doesn't require weeks of work or tens of thousands of crowns. You can verify most of what the agency checks on your own in 15 minutes, and whatever can be fixed can be fixed quickly.

Do you need to have a cookie consent notice on your website?

Yes, if the website uses anything other than technical cookies—typically Google Analytics, Sklik, Meta Pixel, or another analytics or advertising tool. You must obtain consent before these cookies are stored on the visitor’s device, not after they click „I Agree“ two days later.

The scope of the obligation varies depending on what is actually running on the website:

If your website uses only technical cookies and you don’t have any tracking or advertising scripts, a cookie banner is not required. However, you must still fulfill your disclosure obligation in another way, such as by including a separate cookie policy page in the website’s footer. In practice, this applies to very few people: as soon as you add Google Analytics for management reports, the issue of consent comes back into play.

And this applies to small websites and sole proprietors as well. The law does not distinguish between the size of a website or a company's revenue.

What exactly does the law say, and when does it take effect?

The rules governing cookies are set forth in Act No. 127/2005 Coll., on Electronic Communications, specifically Section 89(3). Until the end of 2021, this section was worded loosely enough that website operators (and often experts in the field) interpreted it as an “opt-out” provision: anything a user did not explicitly reject was automatically considered consented to.

Amendment No. 374/2021 Coll. resolved this ambiguity. As of January 1, 2022 A clear opt-in principle applies: the user must actively give consent in advance, and without it, you may only process data that is necessary for the operation of the website.

Whenever cookies process personal data—which is practically always the case with analytics and marketing cookies—the GDPR (General Data Protection Regulation) also applies. Both regulations are then assessed by the same authority, which reviews them together during inspections.

Six Conditions That Consent Must Meet

The Office for Personal Data Protection (ÚOOÚ) responded to questions about cookie banners, and based on its statement, it is possible to identify six criteria that will help you determine whether your banner complies with the requirements—including the details, not just the main principle.

• Saying no has to be just as easy as saying yes. The „Reject All“ button is located on the same, topmost layer of the toolbar as „I Agree.“ If a visitor must click through to detailed settings in order to reject the terms, the consent is not valid.
• No pre-checked boxes. All non-technical categories must remain disabled by default. The visitor always makes the selection themselves by actively clicking.
• The website must function even without consent. Access to content must not be contingent on accepting cookies; a so-called "cookie wall" is against the law.
• Consent must be an active expression of will. Closing the tab with the "X" or simply continuing to browse the website does not count as consent.
• Revoking a license must be just as easy as granting one. Typically via a link in the website's footer that reopens the toolbar.
• You must be able to provide proof of consent. During an audit, you must demonstrate when and to what, specifically, the visitor agreed.

In practice, this last condition is most often overlooked. The bar itself—which appears and disappears—doesn't prove anything. You need a tool that saves the selection and can retrieve it during a review.

What to Do About Google Analytics and Advertising When Consent Is Missing

Starting in 2024, Google requires European websites to use what’s known as “Consent Mode”—a signal that the cookie banner sends to Google Analytics and Google Ads indicating whether a visitor has consented to analytical and advertising cookies or not. Without this setting, you risk Google gradually limiting your conversion tracking and the accuracy of your ad campaigns, regardless of what Czech law says.

If a visitor rejects cookies, Consent Mode does not stop tracking entirely. Instead of using exact data, it estimates the missing portion using a model based on aggregated and anonymized information from other visitors. The numbers are therefore less accurate, but at least they aren’t completely empty.

For a typical corporate website, this means one thing in practice: it’s not enough to simply link the cookie banner to your own text about the GDPR; it must also be linked to analytics tools so that scripts run only after consent is given—not before, and independently of it.

How much could it cost you if you don't address this?

The theoretical maximum fine under the GDPR sounds impressive: up to 20 million euros, or 4 % of global annual revenue companies, whichever is higher. In practice, however, the Office for Personal Data Protection (ÚOOÚ) sets the limit for cookies several orders of magnitude lower, which is precisely why it makes sense to know the actual figures, not just the statutory cap.

In 2023, the agency imposed fines totaling 4,443,000 CZK, of which are final 1,640,000 CZK. The highest single final fine 898,000 CZK The fine was imposed on a company in the electronic communications sector, specifically for setting cookies for marketing purposes without consent.

Jiří Kaucký, Chairman of the Office for Personal Data Protection (ÚOOÚ), stated in a press release that after the amendment took effect, the office initially did not impose fines but merely „educated, warned, and reprimanded.“ It did not impose fines until after operators had been given „sufficient time and opportunity to bring their processing of personal data via cookies into compliance with the GDPR.“.

In other words: the grace period is over. According to the agency’s own summary, the most common errors it found during its inspections include cookies stored before consent was given, insufficient user information, the inability to withdraw consent, misleadingly designed buttons (technically known as a “deceptive design pattern,” meaning an interface that deliberately pushes users toward a single choice), and a cookie banner that does not respond to individual settings at all.

What is the current situation regarding fines? The most recent summary of fines related to cookies, which we found in the ÚOOÚ’s press releases, comes from August 2023 and covers the first seven months of that year. We were unable to find a more recent report, but according to the agency’s statements, monitors websites both on its own initiative and in response to reports. Therefore, consider the figures from 2023 as a general guide, not as a guarantee that you will never be subject to an audit.

Our Approach: Check Your Website Yourself in 15 Minutes

Before you tackle a new tool or an audit from an agency, open your own website in an incognito browser window and go through this list. These are exactly the points that the ÚOOÚ focuses on most often during its inspections.

1. Check the buttons in the first row of the toolbar. There must be both „Accept All“ and „Reject All,“ both the same size and equally visible. If „Reject“ is just small text in the corner, you have a problem.
2. Click „Reject All“ and monitor network traffic. In the developer tools (F12 key, Network tab), check to see if Google Analytics or the Meta pixel is still loading even after you've blocked it.
3. Open the toolbar's advanced settings. No category other than technical cookies may be pre-selected.
4. Find the link to withdraw your consent. It should be in the footer of the website, usually under the heading „Cookie Settings“ or something similar.
5. Try using the website without closing the tab. If you can't access the content at all until you select something, it's a "cookie wall.".
6. Review your own list of cookies. It should specify the names, duration, and purpose of the cookies, not just a general statement such as „This website uses cookies.“.

If you encounter even one of these issues, it is not a minor flaw. These are precisely the types of errors that the agency has most frequently penalized during its inspections.

And if you find that very few people are managing the cookie banner on the website anymore, it’s worth taking a broader look at the situation: who has access to the website, who makes changes, and who is responsible if something goes wrong. We cover this in detail in the article about, How to Ensure Scalability and Website Management.

How much does it cost to have it done right?

Prices vary mainly depending on whether you want just a basic consent banner or a comprehensive tool with consent management, archiving, and integration with Google Consent Mode. This is an approximate market range verified from publicly available price lists; the actual price always depends on the scope of the website and the specific provider.

• Free built-in solution. Both WordPress and Shoptet offer ready-made plugins for cookie bars with no monthly fee. The downside is that you often have limited options for customizing the text and design to match your own website.
• A specialized tool for small and medium-sized websites It will cost about 700 to 1,000 CZK per month, based on the number of domains and traffic.
• International platforms with advanced features (automatic cookie scanning, Consent Mode support, multiple languages) range from approximately 170 CZK per month from the lowest rate for a single domain up to 2,000 CZK or more per month for high-traffic websites.
• Turnkey Implementation, where the provider sets everything up for you—including connecting to the measurement tools—costs around 3,000 CZK as a one-time payment.

For a company that operates in multiple countries or processes dozens of audit consents daily, it makes sense to opt for a comprehensive platform. For a standard company website or a smaller e-shop, however, a well-configured plugin and a one-time check to ensure it meets all six conditions from the previous chapter are often sufficient.

If you're addressing the cookie bar as part of a larger project—such as a website redesign or selecting a new agency—be sure to include it in your requirements right away. Just as with Web Development Contracts It's generally cheaper to handle this in advance than to deal with it later, once the website is live and cookies are being set retroactively in the finished code. If You're switching web agencies, a functional and verifiable cookie banner is one of the items you should request as part of the handover.

Not sure if this applies to you? Contact us and we'll walk you through it step by step on your website.

Frequently Asked Questions About Cookies on the Website

A cookie banner seems like a minor detail that gets taken care of once and then forgotten about for the next few years. In reality, it falls into the same category as website accessibility, SSL certificate or regular website backup: an obligation that no one addresses until an audit comes along or the website goes down. At Apadore, we discuss cookie bar settings and the rest of the website’s technical maintenance with our clients as a standard part of website management, not as an optional extra.