CNIL cookie rules: what a site for French visitors must do

The CNIL cookie guidance comes down to three rules for any site with visitors in France: no tracker that needs consent may run before the visitor chooses, refusing must be as easy as accepting, and the visitor must be able to change their mind as easily later. Audience measurement is the one useful exception: it can run without consent if the tool meets the CNIL's conditions.

The CNIL (Commission nationale de l'informatique et des libertés) is the French data protection authority. It enforces article 82 of the French Data Protection Act (loi Informatique et Libertés), which transposes article 5(3) of the EU ePrivacy Directive. Because article 82 is French law rather than the GDPR, the CNIL can act against any company whose trackers run on devices in France, without passing the case to an authority in another EU country. That is why the largest cookie fines in Europe are French, and why they reach companies based in Ireland, the US and Singapore.

This guide is for a business outside France with French customers: an online store shipping to France, a SaaS with French users, a Belgian or Swiss company with a French-language site. It sets out the guidance, the exemption for analytics, what the fines were for, and how a banner that holds up in France looks.

The guidelines and the recommendation

The CNIL adopted two texts on 17 September 2020 and published them on 1 October 2020: guidelines that say what the law requires, and a recommendation that shows practical ways to comply. It gave sites until 31 March 2021 to adapt, and has enforced them since.

The information has to be readable by a French consumer, which in practice means French. The loi Toubon requires French in consumer-facing information in France; a translation next to another language is allowed, an English-only banner for French customers is a risk of its own.

Analytics without consent: the CNIL exemption

France is stricter than its neighbours on most points, and more flexible on one: audience measurement. The CNIL exempts trackers used only to measure the audience of a site or app from consent, under conditions it lists in its guidelines and in its practical sheet on analytics:

• the purpose is limited to measuring the audience of the site or app, for its own use: visits, pages, performance, A/B tests of the site itself;
• the data is not combined with other processing and not passed to third parties for their own use;
• the tracker works on one site or app only, not across sites;
• the IP address is truncated or not collected, so that it cannot locate the visitor more precisely than the city;
• the tracker lives at most 13 months, and its lifetime does not extend with each visit; the data is kept at most 25 months;
• visitors are informed and can object, for example with a switch in the cookie settings.

Some tools are configured for this; the CNIL lists products that can meet the conditions when set up correctly, and is clear that no product is certified by it. The standard setup of the most common analytics product, with data used by its vendor and linked to advertising, does not meet them.

The UK went in a similar direction in February 2026, with its own conditions; see UK cookie law. Most other EU authorities, including the Belgian and German ones, still require consent for analytics. The EU's digital omnibus on cookies may change that for the whole EU, but not yet.

What the CNIL fined, and for how much

Shein's decision weighed the scale: about 12 million visitors a month from France. Both companies said they would contest their 2025 decisions. Google was also ordered to change within six months under a penalty of 100,000 euros per day.

These are giants, but the patterns are the same on small sites: a tag manager that fires before the banner answers, a reject option buried in a second layer, a refusal that the site ignores. The CNIL also runs checks on smaller sites and sends formal notices before fining; most cases end there, with a deadline to fix the banner.

A banner for France, Belgium and the rest

A site for French visitors usually serves other markets too. Building to the CNIL standard is the safest base for the whole EU, because the CNIL is the strictest on form and its rules match the EU directive everyone shares.

For a site in French and Dutch for Belgium, or in French for France and Belgium, one banner can cover both: Refuse and Accept on the first layer, purposes per category, and the analytics category off by default for Belgian visitors. How we build sites in several languages is on multilingual website development, and what Belgium asks of a site in two languages is in a website in French and Dutch.

Checking your own site for France

1. Open the site in a private window with the browser set to French, and the developer tools on the Storage tab. Do not touch the banner.
2. Look at the cookies and local storage. Only your own session, basket or language cookie should be there, and an exempt measurement cookie if your tool meets the conditions.
3. Look at the Network tab. No request should go to an advertising platform yet.
4. Click Refuse. Reload. The same list should be there as before.
5. Find the link that reopens the choice, on a page other than the home page.
6. Read the banner as a French visitor would: is each purpose named in French, and are the partners listed?

If an advertising cookie appears at step 2, your tags fire before consent; that was the core of the Amazon, Google and Shein findings. For the EU baseline behind all of this, see do I need a cookie banner; for the Meta pixel specifically, see what is Meta pixel.