European GDPR and Subscription Consent Requirements vs US Law

On a single day in September 2025, France's data protection authority, the CNIL, fined Google €325 million and Shein €150 million for cookie consent failures. Google's penalty also covered a separate violation: showing Gmail ads without getting prior consent from users first. Nothing comparable happens under US federal law for the same kind of conduct, and that's not an enforcement gap so much as a difference in what each legal system thinks consent actually is. Europe starts from the position that consent is a right a person has to actively exercise before a company touches their data; the US has built its rules around disclosure, where a company tells you what it's doing and the burden falls on you to opt out if you don't like it. The same dark-pattern cancellation flow, the same pre-checked analytics box, the same free trial that slides into a paid plan without a clear heads-up can draw no federal action at all in the US while costing a European operator nine figures.

What GDPR requires before a subscription relationship can begin

GDPR treats subscription consent as a gate. A company can't start collecting data beyond what's strictly needed to run the service until that gate opens, and the gate only opens when four conditions are met at the same time. Article 4(11) spells them out: consent has to be freely given, specific, informed, and unambiguous. If any one of the four conditions is missing, the consent is void.

Freely given means a person has to have a real choice, with no penalty for saying no. A company can't degrade or withhold a service just because someone declined something non-essential. Specific means no blanket "I agree to everything" checkbox: a customer has to be asked separately about billing notices, marketing emails, and analytics tracking, since bundling them together makes it a single vague request rather than a specific one. Informed sets a disclosure floor that European regulators have written out in detail: the EDPB's Guidelines 05/2020 require a company to name itself, state the purpose of each processing activity, list what data it's collecting, and tell people how to withdraw, all in plain language at the moment of decision rather than tucked into a privacy policy nobody reads. Unambiguous rules out silence and inaction as consent: a pre-ticked box, or a notice that says continuing to browse counts as agreement, doesn't meet the bar.

What makes this an architecture rather than a checklist is that it runs across the whole life of a subscription, including every billing cycle after the signup page. Consent obligations follow the relationship through every billing cycle, every mid-subscription email, and all the way to data deletion when someone cancels. Article 7(4), sometimes called the anti-bundling rule, closes a loophole companies might otherwise use: if an online store makes marketing email consent a condition of finishing a purchase, that consent is invalid, because the company made something non-essential a requirement for the service itself. GDPR's granular model means a subscription legally starts only after a string of separate, specific yeses, one for billing, one for marketing, one for analytics, and each of those has to be withdrawable on its own. That matters most to the person signing up, because consent bundling and default opt-ins are easy to miss: a subscription can go live on terms a person never actually agreed to, which is part of why background monitoring tools that flag unexpected consent entanglements and surprise subscriptions have become useful rather than optional.

Cookie consent and GDPR enforcement in 2026

Cookies are where this architecture meets the real world most often, and by 2025 and into 2026, cookie consent had become the most actively enforced corner of European data protection law. Two separate rules apply at once: the ePrivacy Directive requires consent before a company places any non-essential cookie, and GDPR sets the standard for whether that consent counts.

What counts as a cookie, in the legal sense, keeps expanding. The EDPB's Guidelines 2/2023, finalized in October 2024, extended Article 5(3) well past the old idea of an HTTP cookie to cover tracking pixels embedded in a page, tracking identifiers in a URL, device fingerprinting, HTML5 local storage used for tracking, and any form of tracking across sites or devices. Tools like Google Analytics, Meta Pixel, Hotjar, and Microsoft Clarity all fall inside that net, along with advertising cookies, A/B testing software, session replay tools, and embedded social media widgets. The exemption for cookies that don't need consent stays narrow: session cookies, login tokens, shopping cart cookies, and CSRF security tokens qualify, but analytics and personalization never do, no matter how a company's engineering team labels them internally.

European regulators issued €1.2 billion in GDPR penalties across 2025 alone, up from the year before, with the Google and Shein fines as the headline figures. What's notable is how specific the enforcement has gotten: regulators aren't just fining companies for missing a cookie banner, they're fining them for technical failures buried inside banners that look fine on the surface. France's CNIL has fined companies for having no "Reject All" option at the first layer of the banner. Spain's AEPD has fined a company for letting analytics cookies fire before a visitor had clicked anything in the consent tool at all. Italy's Garante has issued fines over tracking that kept running after someone had already opted out. By 2026, the standard regulators apply draws a hard line between a banner that looks compliant and one that actually behaves that way: if non-essential scripts fire before a visitor interacts with the consent tool, the banner fails the test no matter what it displays on screen. Proving compliance now takes more than a screenshot. Companies need timestamped consent logs, HAR files showing network requests, and technical evidence that scripts were actually blocked until consent was given.

The US approach: disclosure obligations, a vacated rule, and the enforcement vacuum that replaced it

US law has never treated subscription consent as something a company has to earn upfront. The federal framework runs on disclosure and opt-out instead, which pushes the compliance burden downstream, onto the moment a customer notices a charge and decides to act, rather than onto the moment they signed up. The main federal statute here, the Restore Online Shoppers' Confidence Act, requires online sellers to state their terms clearly, get informed consent, and offer a simple way to cancel, but it never defines what "simple" means in practice, and it says nothing about granular consent for different kinds of data use.

The FTC tried to close that gap with a rule plain enough to enforce: its Click-to-Cancel rule. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated it, not because the rule's substance was flawed, but on a procedural ground: the FTC skipped a required preliminary regulatory analysis for a rule expected to carry an annual economic impact above $100 million. The agency restarted the rulemaking process from the beginning, and no federal click-to-cancel rule is currently in force.

Without a standing rule, the FTC has to lean on Section 5 of the FTC Act, the general ban on unfair or deceptive practices, and bring cases one company at a time. That approach can produce large numbers. Amazon settled Prime allegations, described in the research as involving a cancellation path of "four pages, six clicks and fifteen options," for $2.5 billion in September 2025. Match Group paid $14 million in August 2025 over deceptive advertising, misleading subscription guarantees, a complicated cancellation process, and retaliatory billing. Chegg agreed to a $7.5 million proposed order in September 2025 for cancellation routes the FTC called unintuitive. Instacart settled for $60 million in December 2025 over deceptive advertising, including false free-delivery claims, refund misrepresentations, and free-trial-to-paid conversions the FTC said were never properly authorized. Adobe faces a $150 million proposed order from March 2026, split into $75 million in penalties and $75 million in free services, over a hidden early termination fee and cancellation friction. And in January 2026, the FTC sued JustAnswer, alleging customers believed they were paying a small one-time fee but were instead enrolled in recurring monthly charges without ever giving clear consent to that.

Those settlements show the FTC can extract real money from individual companies, but each case takes years to build and only touches the one business named in it, while GDPR enforcement applies across an entire sector at once. That asymmetry has a direct effect on the people actually paying these subscriptions: in the US, spotting an unwanted charge or a sneaky opt-out is a job that falls on the subscriber, while in Europe the law is built to stop that charge from starting in the first place. That difference is a large part of why monitoring tools built to catch unauthorized charges, pre-ticked consent boxes, and trial conversions across borders carry more weight as the two systems keep drifting apart.

State law filling the federal vacuum

Federal law left a hole, and state law has been filling it faster than most people realize. More than half of US states now have their own laws covering automatically renewing subscriptions, which leaves any company operating nationally to navigate a patchwork instead of a single federal standard.

The most advanced version of this so far comes from a city rather than a state. New York City has adopted a click-to-cancel rule, the first of its kind at the municipal level, taking effect October 1, 2026, city officials said. The rule requires that canceling a subscription be no harder than signing up for one, through the same channel used at signup, and it requires an online cancellation path to exist even for services a customer originally joined in person. Timing rules are specific: renewal notices have to go out 15 to 45 days before a renewal deadline, and free-trial charge notices have to go out 3 to 21 days ahead of the charge. Penalties run $525, $1,050, and $3,500 per violation, and each deceptive statement is counted on its own, so a single notice with several misleading claims can stack multiple penalties.

Taken together, state and municipal rules are drifting toward something that looks more like the European model: proactive notice before a charge, an easy way to back out, and penalties counted per violation rather than per company. What that produces, though, is uneven protection depending entirely on where a subscriber happens to live.

Consent-or-pay: what Europe requires that the US never considered

The clearest fault line between the two systems appears in a design choice large platforms have started offering: pay a subscription fee, or accept behavioral advertising in exchange for a free tier, and in the US no regulator has set out what a genuine free choice looks like in that kind of setup, with the question drawing no serious regulatory debate at all.

Europe has already answered it. In April 2024, the European Data Protection Board issued a formal opinion, requested jointly by several national data protection authorities, concluding that in most cases, a large online platform can't get valid GDPR consent through a simple pay-or-consent setup. That's a question American regulators haven't had to answer yet, mostly because American consent law was never built around the idea that a choice could be invalid on the grounds that it was too expensive to refuse.

The underlying asymmetry traces back to where each system places the point of decision. GDPR asks whether a person had a real option before anything started. US law asks whether a person was told what was happening and given a door to walk out through afterward. As enforcement on the European side keeps accelerating into nine-figure territory, the gap between a non-compliant consent flow and a serious fine has narrowed to the point where relying on personal vigilance to catch every violation or unauthorized data use isn't realistic for most consumers. Automated tracking of which subscriptions and services obtained real, affirmative consent, and in which jurisdiction, has gone from a convenience to something closer to a requirement for anyone trying to keep up with where these two systems actually stand.