EU DSA Compliance Checker: Cookie Consent and Fine Risk

Assess your Digital Services Act scope, detect dark pattern cookie banners, and quantify statutory fine exposure up to 6% of global turnover.

DSA fines, VLOP status and cookie risk: calculation and example

The Digital Services Act (Regulation (EU) 2022/2065) caps fines at 6% of annual worldwide turnover and periodic penalty payments at 5% of average daily turnover. A platform becomes a very large online platform (VLOP) at 45 million monthly active users in the EU. The tool computes these ceilings, the GDPR ceiling that applies to cookies (€20M or 4%), and an indicative compliance index.

What the tool calculates

  • DSA fine ceiling = 6% of the annual worldwide turnover entered.
  • Maximum daily penalty payment = turnover ÷ 365 × 5%.
  • GDPR ceiling applied to cookies = the higher of €20M and 4% of turnover.
  • VLOP status: reached at 45 million monthly active users in the EU. The service type does not change it.
  • Compliance index, the tool's own heuristic: 100 minus risk points, kept between 5 and 100. It adds 0.8 point per point of banner score below 70%, 35 for dark patterns, 25 without a notice-and-action mechanism, 30 for a marketplace without seller checks (Art. 30) and 15 for a VLOP. Below 50 the risk is critical, 50 to 74 moderate, 75 and above low.

Example

Marketplace, 12 million users, €45M turnover, banner scored 40%, dark patterns present, reporting and seller checks in place: (70 − 40) × 0.8 + 35 = 59 points, index 41/100, critical. DSA ceiling: €2,700,000. Maximum penalty payment: €6,164 per day. GDPR ceiling: €20,000,000, since 4% would only be €1.8M.

Limits

These are legal maximums, not a forecast. Article 25 DSA on deceptive interfaces does not apply to practices already covered by the GDPR or the Unfair Commercial Practices Directive; for cookie banners, the "refusing must be as easy as accepting" rule comes from the French CNIL guidelines. No legal advice is given. For GDPR breaches beyond cookies, see the GDPR fine simulator; for deletion deadlines, the retention period guide.

Sources and dates: Regulation (EU) 2022/2065, Art. 25, 33 (45 million threshold), 52 and 74 (6%), 76 (5% penalty payments), applicable to all platforms since 17/02/2024 (European Commission, DSA enforcement); GDPR Art. 83(5), applicable since 25/05/2018 (CNIL, text of GDPR Chapter VIII); CNIL cookie guidelines (deliberation 2020-091 of 17/09/2020) and recommendation (CNIL cookie Q&A) (checked 14/10/2026).

Frequently Asked Questions

What is the maximum fine under the DSA?

A fine cannot exceed 6% of the provider's annual worldwide turnover in the preceding financial year. With €45M of turnover, the ceiling is €2.7M. The cap applies both to Member State penalties and to Commission fines on very large platforms.

How many users make a platform a VLOP?

The threshold is 45 million average monthly active recipients in the Union, about 10% of the EU population. The Commission then designates the platform, and the extra obligations apply four months after the designation is notified.

How is the DSA daily penalty payment calculated?

It can reach 5% of average daily worldwide turnover in the preceding financial year, per day of delay. The tool divides annual turnover by 365 and applies 5%: €45M gives at most €6,164 per day.

Does the DSA ban dark patterns in cookie banners?

Article 25 DSA bans deceptive platform interfaces but excludes practices already covered by the GDPR. Cookie banners therefore fall mainly under the GDPR and ePrivacy rules. In France, the CNIL has required since its 2020 guidelines that refusing be as easy as accepting, for instance with a "Reject all" button.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.