GDPR Privacy FAQs: Is there a private right of action for failing to comply with European cookie laws?

Maybe.

The GDPR does purport to allow data subjects to bring private rights of action. Likewise, certain implementations of the ePrivacy Directive, like the Privacy and Electronic Communications Regulations, allow for private rights of action under certain circumstances.¹ That said, there is some debate about whether certain Member State’s national systems require the enactment of domestic legislation to officially create or grant the ability of a private individual to enforce the GDPR within the national court system. In any event, any private action based on failure to comply will likely be limited to “compensation for the damages suffered,” since administrative fines (including fines based on percentages of revenue under the GDPR) may only be sought by supervisory authorities.