# CNIL fines 2025-2026: every penalty, and what they mean for small businesses > In 2025 the CNIL, France’s data protection authority, imposed 83 sanctions totalling €486,839,500 in fines, 67 of them under the simplified procedure, capped at €20,000 for a company with worldwide turnover below €50 million. The breaches that come up most are cookies, video surveillance of employees, data security, ignoring individuals’ rights and failing to answer the CNIL. The general cap remains €10 million or 2% of worldwide turnover, rising to €20 million or 4% for the most serious breaches. Source: https://legalnest.io/en/guides/cnil-fines/ Updated on 8 October 2026. Checked against the law in force on 07/10/2026. General information, not personalised legal advice. In 2025, the CNIL (the « Commission nationale de l’informatique et des libertés », France’s data protection authority) imposed [€486,839,500 in fines](https://www.cnil.fr/en/sanctions-and-corrective-measures-cnils-actions-2025), and almost 98% of that sum comes from two decisions of 1 September: €325 million for Google, €150 million for SHEIN. The rest tells a different story. Of the year’s 83 sanctions, 67 were imposed under the simplified procedure, on the likes of a convenience store, a GP, a travel agency, an online shop or a parliamentary candidate. The median amount of those fines, by our count of the official list: €7,000. That second story is the one that matters if you run a French company or sell to French customers. This guide lists every 2025 and 2026 sanction that can be checked on cnil.fr and Légifrance (France’s official legal database), then pulls out what counts for a small business: what actually gets fined, how much, and how the procedure works. ## How much did the CNIL fine companies in 2025? **In 2025, the CNIL imposed 83 sanctions totalling €486,839,500 in fines, €475 million of it from the Google and SHEIN decisions alone.** The 67 simplified-procedure sanctions, reserved for straightforward cases, are capped at €20,000 each. The key figures from the [review published on 9 February 2026](https://www.cnil.fr/en/sanctions-and-corrective-measures-cnils-actions-2025): | 2025 indicator | Figure | |---|---| | Enforcement decisions | 259 | | Sanctions | 83 (16 by the restricted committee, 67 under the simplified procedure) | | Total fines | €486,839,500 | | Formal notices (« mises en demeure ») | 143 | | Reminders of legal obligations | 31 | | Warnings | 2 | | Sanctions made public | 10 | | Organisations sanctioned over cookies | 21 | | Organisations sanctioned over video surveillance of employees | 16 | The 83 sanctions break down into 78 fines (27 of them with an injunction backed by a penalty payment), three liquidated penalty payments and two reprimands (« rappels à l’ordre »). All fines are collected by the French Treasury. 2026 began with a bang. On 8 January, Free Mobile and Free were hit with [€42 million in fines](https://www.cnil.fr/en/sanction-free-2026) after a breach affecting 24 million subscriber contracts, followed by [France Travail, €5 million](https://www.cnil.fr/en/data-breach-5million-fine-france-travail), on 22 January and [IQVIA, €5 million](https://www.cnil.fr/en/health-data-fine-5-million-euros-against-iqvia), on 26 May. At the small end, the CNIL announced on 6 July 2026 [23 simplified sanctions since January](https://www.cnil.fr/fr/23-nouvelles-sanctions-simplifiees) (in French), €133,750 in total. ## Which companies has the CNIL fined in 2025 and 2026? **The table below covers the 99 decisions on the [CNIL’s official list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil), from 9 January 2025 to 2 April 2026 (list updated on 14 April 2026), plus the three sanctions published since.** Organisations sanctioned under the simplified procedure are never named: the law forbids it. How to read it: “simplified” marks a decision taken by a single member of the restricted committee (« formation restreinte », the CNIL body that imposes sanctions), capped at €20,000 (€100,000 since 28 May 2026 for an organisation whose worldwide turnover exceeds €50 million); the other rows are restricted committee decisions. The link goes to the decision on Légifrance when it has been published, otherwise to the CNIL’s list (in French: the table follows the French version of the list). Of the 23 simplified sanctions announced for January to July 2026, 12 are detailed here; the CNIL has not yet published the details of the others, so they are not listed row by row. Type “cookies”, “distance selling” or “doctor” in the filter. ```datatable title="CNIL sanctions 2025-2026" filter Date,Organisation,Amount,Breaches,Source 2026-07-21,Hôpital privé de la Loire,"€500,000","Security, Data breach",[SAN-2026-009](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054790100) 2026-07-21,Extia,"€300,000",Individuals’ rights,[SAN-2026-010](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054810440) 2026-05-26,IQVIA Operations France,"€5,000,000 and injunction","Sensitive data, Information, Individuals’ rights, Security",[SAN-2026-008](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054136834) 2026-04-02,"Unnamed, toilet facilities operator (simplified)","€7,500","Video surveillance, Data minimisation, Lawfulness and purpose, Processors, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-26,"Unnamed, ticketing and events (simplified)","€15,000 and injunction","Cookies, Information, Retention, Individuals’ rights, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-26,"Unnamed, performing arts (simplified)",€850 (penalty payment liquidated),Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-26,"Unnamed, tourist accommodation (simplified)","€3,000","Retention, Data minimisation, Processors",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-12,"Unnamed, government ministry",Reprimand and injunction,"Security, Retention, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-12,"Unnamed, specialist distance selling (simplified)","€5,000","Information, Individuals’ rights",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-05,"Unnamed, association for access to dental care (simplified)","€6,000 and injunction","Security, Information",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-03-05,"Unnamed, fundamental rights association (simplified)","€5,100 (penalty payment liquidated)",Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-02-05,"Unnamed, doctor (simplified)","€1,000 (penalty payment liquidated)",Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-02-05,"Unnamed, lawyer (simplified)","€1,000 (penalty payment liquidated)",Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-01-29,"Unnamed, public urban transport body (simplified)","€20,000","Security, Information, Video surveillance, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-01-29,"Unnamed, religious association (simplified)","€10,000 and injunction","Information, Video surveillance, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-01-22,France Travail,"€5,000,000 and injunction",Security,[SAN-2026-003](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053408671) 2026-01-15,"Unnamed, parliamentary election candidates (simplified)","€2,000 and injunction","Information, Individuals’ rights",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2026-01-08,Free Mobile,"€27,000,000 and injunction","Security, Data breach, Retention",[SAN-2026-001](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053352664) 2026-01-08,Free,"€15,000,000 and injunction","Security, Data breach",[SAN-2026-002](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053352643) 2025-12-31,"Unnamed, university (simplified)","€20,000",Lawfulness and purpose,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-30,"Unnamed, hotel management (simplified)","€5,000","Information, Video surveillance, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-30,"Unnamed, airport freight (simplified)","€10,000","Security, Retention, Video surveillance, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-30,"Unnamed, dental surgeon (simplified)",Reprimand,Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-30,"Unnamed, tertiary sector","€3,500,000","Cookies, Security, Information, Lawfulness and purpose, DPIA",[SAN-2025-017](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053391342) 2025-12-29,"Unnamed, newspaper publishing (simplified)","€5,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-29,"Unnamed, newspaper publishing (simplified)","€7,000 and injunction",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-29,"Unnamed, large retailer (simplified)","€6,000 and injunction","Cooperation with the CNIL, Video surveillance, Data minimisation",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-29,"Unnamed, mobile app publisher","€270,000","Cookies, Security, Sensitive data",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-22,Nexpublica France,"€1,700,000",Security,[SAN-2025-015](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053151799) 2025-12-18,"Unnamed, lead generation through prize draws (simplified)","€20,000","Direct marketing, Security, Retention",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-18,"Unnamed, rental management software publisher (simplified)","€15,000 and injunction","Direct marketing, Security, Information, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-18,"Unnamed, prospecting for advertising agencies (simplified)","€6,000",Individuals’ rights,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-18,"Unnamed, landscaping (simplified)","€7,000","Individuals’ rights, Cooperation with the CNIL",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-18,"Unnamed, travel agency (simplified)","€2,000 and injunction",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-15,"Unnamed, payroll software publisher (simplified)","€15,000",Security,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-15,"Unnamed, specialist grocery (simplified)","€8,000 and injunction","Retention, Video surveillance, Data minimisation, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, 2024 parliamentary candidate (simplified)","€5,500","Information, Individuals’ rights, Lawfulness and purpose, Processors",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, 2024 parliamentary candidate (simplified)","€2,500",Information,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, 2024 parliamentary candidate (simplified)","€5,000","Direct marketing, Security, Information, Individuals’ rights, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, 2024 parliamentary candidate (simplified)","€2,500","Direct marketing, Information, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, performing arts (simplified)","€5,000 and injunction",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, building works and property brokerage (simplified)","€3,000 (penalty payment liquidated)",Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,Mobius Solutions Ltd (processor),"€1,000,000","Retention, Record of processing, Processors",[SAN-2025-014](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053048614) 2025-12-11,"Unnamed, victim support (simplified)","€20,000 and injunction","Direct marketing, Information, Individuals’ rights",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-11,"Unnamed, public social housing landlord (simplified)","€20,000 and injunction","Security, Information, Individuals’ rights, Data minimisation, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-08,"Unnamed, retail trade (simplified)","€20,000","Security, Information, Retention, Video surveillance, Data minimisation, Lawfulness and purpose, Processors, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-04,"Unnamed, political party (simplified)","€5,000 and injunction","Security, Retention, Individuals’ rights",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-12-04,"Unnamed, hotel business (simplified)","€10,000",Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-27,American Express Carte France,"€1,500,000",Cookies,[SAN-2025-011](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827) 2025-11-27,"Unnamed, distance selling","€500,000 and injunction",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-27,"Unnamed, website and app development (simplified)",Measure not specified by the CNIL,"Security, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-27,"Unnamed, 2024 European election candidate (simplified)","€8,000 and injunction","Direct marketing, Individuals’ rights, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-27,"Unnamed, care support services",Injunction with penalty payment,"Record of processing, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-20,"Unnamed, holding company, HR solutions (simplified)","€10,000","Individuals’ rights, Cooperation with the CNIL",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-20,Les Publications Condé Nast (vanityfair.fr),"€750,000",Cookies,[SAN-2025-010](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052851847) 2025-11-13,"Unnamed, footwear retailer (simplified)","€5,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-13,"Unnamed, shopping centre economic interest group (simplified)","€20,000","Security, Information, Video surveillance, Data minimisation, Lawfulness and purpose, Record of processing, Processors, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-13,"Unnamed, food retailer (simplified)","€20,000","Security, Retention, Video surveillance, Data minimisation, Lawfulness and purpose, Record of processing, Processors, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-13,"Unnamed, company information portal (simplified)","€5,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-05,"Unnamed, law firm (simplified)","€5,000","Individuals’ rights, Cooperation with the CNIL",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-04,"Unnamed, local authority (simplified)","€4,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-11-04,"Unnamed, consultancy for diving clubs (simplified)","€4,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-16,"Unnamed, supermarket (simplified)","€20,000 and injunction","Information, Video surveillance, Data minimisation, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-16,"Unnamed, specialist distance selling (simplified)","€3,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-16,"Unnamed, magazine and periodical publishing (simplified)","€4,000 and injunction",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-16,"Unnamed, call centres","€250,000","Security, Retention, Data minimisation",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-16,"Unnamed, sports and leisure centres (simplified)","€20,000 and injunction","Cookies, Security, Information",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-09,"Unnamed, general distance selling (simplified)","€4,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-10-02,"Unnamed, university (simplified)","€15,000",Lawfulness and purpose,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-18,Samaritaine,"€100,000","Data breach, Video surveillance, Data minimisation, Lawfulness and purpose, DPO",[SAN-2025-008](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052266505) 2025-09-11,"Unnamed, banking and insurance (simplified)","€10,000","Information, Individuals’ rights",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-11,"Unnamed, specialist distance selling (simplified)","€5,000",Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-11,"Unnamed, association running a secondary school and boarding house (simplified)","€7,000 and injunction","Security, Retention, Video surveillance, Data minimisation",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-11,"Unnamed, municipality (simplified)","€10,000 and reprimand","Security, Retention, Sensitive data, Record of processing",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-11,"Unnamed, general practice doctor (simplified)","€3,000 and injunction",Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-04,"Unnamed, recruitment software publisher (simplified)","€7,000","Security, Data breach, Record of processing, Processors",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-04,"Unnamed, lead generation through prize draws (simplified)","€17,000","Direct marketing, Information, Retention, Lawfulness and purpose, Record of processing",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-04,"Unnamed, large retailer","€75,000 and injunction","Information, Video surveillance, Data minimisation, Lawfulness and purpose, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-03,"Unnamed, property development (simplified)","€20,000",Individuals’ rights,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-09-01,Google LLC and Google Ireland Limited,"€325,000,000 and injunction","Cookies, Direct marketing",[SAN-2025-004](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182222) 2025-09-01,SHEIN (Infinite Styles Services Co. Limited),"€150,000,000",Cookies,[SAN-2025-005](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182271) 2025-08-25,"Unnamed, fundamental rights association (simplified)","€10,000 and injunction","Individuals’ rights, Cooperation with the CNIL",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-07-17,"Unnamed, lawyer (simplified)","€3,000 and injunction","Individuals’ rights, Cooperation with the CNIL",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-07-03,"Unnamed, distance selling of furniture and home decor","€600,000","Cookies, Direct marketing, Information, Retention",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-07-03,"Unnamed, doctor (simplified)","€3,000 and injunction",Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-06-18,"Unnamed, general distance selling (simplified)","€3,000",Cookies,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-06-05,"Unnamed, pharmaceutical products for the food industry (simplified)","€5,000","Video surveillance, Data minimisation",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-06-05,"Unnamed, private clinic (simplified)","€5,000","Information, Video surveillance, Data minimisation, Lawfulness and purpose, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-06-05,"Unnamed, publishing (simplified)","€10,000 and injunction",Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-05-15,"Unnamed, private security (simplified)","€4,000 (penalty payment liquidated)",Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-05-15,Solocal Marketing Services,"€900,000 and injunction","Direct marketing, Lawfulness and purpose",[SAN-2025-001](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051630617) 2025-05-15,Caloga,"€80,000","Direct marketing, Retention, Lawfulness and purpose",[SAN-2025-002](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051660380) 2025-04-30,"Unnamed, dating site (simplified)","€20,000","Security, Data breach, Information, Retention, Sensitive data, Processors",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-04-10,"Unnamed, sporting goods shop (simplified)","€20,000","Security, Information, Retention, Video surveillance, Data minimisation, Record of processing",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-04-10,"Unnamed, restaurant business (simplified)","€6,000","Information, Video surveillance, Data minimisation, Record of processing, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-04-03,"Unnamed, convenience store (simplified)","€5,000 and injunction",Cooperation with the CNIL,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-04-03,"Unnamed, building works and property brokerage (simplified)","€10,000 and injunction","Information, Cooperation with the CNIL",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-03-27,"Unnamed, business consultancy (simplified)","€6,000","Information, Video surveillance, Data minimisation, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-01-30,"Unnamed, energy brokerage (simplified)","€4,000 (penalty payment liquidated)",Injunction not complied with,[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-01-23,"Unnamed, road haulage (simplified)","€8,000","Information, Retention, Geolocation, Data minimisation, DPIA",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-01-16,"Unnamed, distance-learning apprentice training centre (simplified)","€10,000 and injunction","Information, Retention, Individuals’ rights, Video surveillance, Data minimisation",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) 2025-01-09,"Unnamed, insulation and heating works (simplified)","€15,000 and injunction","Direct marketing, Data minimisation, Accuracy, Lawfulness and purpose",[CNIL list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) ``` Closures of injunctions ([KASPR in March 2026](https://www.cnil.fr/en/closure-order-issued-against-kaspr), [Solocal in September 2026](https://www.cnil.fr/fr/cloture-injonction-solocal-marketing-services), in French) are not sanctions and are not listed. Nor is the €824,990,000 fine on Uber, [announced by the CNIL on 24 August 2026](https://www.cnil.fr/en/automated-decisions-uber-fined-nearly-eur-825-million): it was imposed by the Dutch data protection authority, in cooperation with the CNIL. ## What are the most common reasons for CNIL fines? **Cookies, data security, ignoring individuals’ rights, failing to answer the CNIL and video surveillance of employees were the most frequent grounds for sanctions in 2025.** Information given to individuals and retention periods also come up in a large share of cases. | Breach | Count in 2025 | What was found | |---|---|---| | Cookies and trackers | 21 organisations (CNIL) | Trackers placed before any choice, insufficient information, refusal or withdrawal of consent not respected | | Video surveillance of employees | 16 organisations (CNIL) | Cameras permanently filming tills or offices, hidden cameras | | Data security | 14 organisations under the simplified procedure (CNIL) | Weak passwords, accounts shared between users | | Failure to cooperate with the CNIL | 14 organisations under the simplified procedure (CNIL) | No answer to the CNIL’s requests | | Individuals’ rights | 14 simplified-procedure decisions (CNIL) | Access, erasure or objection requests ignored | | Commercial or political direct marketing | 10 decisions (CNIL) | Emails or texts without consent, consent impossible to prove | | Information to individuals | 25 of 83 decisions (our count) | Privacy policy missing or incomplete, missing CCTV signs | | Retention period | 17 of 83 decisions (our count) | Data kept indefinitely, or longer than the stated period | The first six rows come from the [CNIL’s 2025 review](https://www.cnil.fr/en/sanctions-and-corrective-measures-cnils-actions-2025); the last two from our count of the “main breaches” in its [list of sanctions](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) (in French). A single decision often covers several breaches. What stands out in the list is that small organisations are not fined for sophisticated schemes. A distance-selling shop paid €3,000 on 16 October 2025 for a single breach: cookies placed without consent. A sporting goods shop hit the €20,000 cap on 10 April 2025 by combining video surveillance of employees, no record of processing and poor security. A payroll software publisher was fined €15,000 on 15 December 2025 for security alone. Cookies remain the most visible target, because an online check is enough to spot the problem: the law allows CNIL agents to inspect from the internet, including under an assumed identity ([art. 19 of the « loi Informatique et Libertés »](https://www.cnil.fr/fr/la-loi-informatique-et-libertes), the French Data Protection Act, in French). The consent rule itself is EU-wide (it comes from the ePrivacy Directive), but in France it is enforced by the CNIL under article 82 of that Act. In 2026, the CNIL was still fining banners where accepting took one click while refusing meant going through “Customise”. Our guide to a [CNIL-compliant cookie banner](/en/guides/cookie-banner-france-cnil/) sets out the rules, and the [free cookie checker](https://app.legalnest.io/tools/cookies?lang=en) shows the trackers your site places on first load. ## How much can the CNIL fine a small business? **A small business is usually dealt with under the simplified procedure, where the fine cannot exceed €20,000 and the penalty payment €100 per day of delay, as long as its worldwide turnover does not exceed €50 million.** Above that threshold, the caps have been €100,000 and €500 per day since 28 May 2026. **What the law says** > Le président de la commission peut engager les poursuites selon la procédure simplifiée lorsqu’il estime que les mesures correctrices prévues aux 1°, 2° et 7° du IV et 1° et 2° du V de l’article 20 constituent la réponse appropriée à la gravité des manquements constatés, sous réserve que l’amende administrative encourue, mentionnée au 7° du IV et au 3° du V du même article 20, n’excède pas un montant de 20 000 € et que l’astreinte encourue, mentionnée au 2° des IV et V dudit article 20, n’excède pas un montant de 100 € par jour de retard à compter de la date fixée par la décision. Lorsque le chiffre d’affaires annuel mondial total de l’exercice précédent du responsable de traitement est supérieur à 50 millions d’euros, ces montants sont portés, respectivement, à 100 000 euros d’amende et à 500 euros par jour d’astreinte. > > *Unofficial translation:* The chair of the commission may bring proceedings under the simplified procedure where they consider that the corrective measures provided for in 1°, 2° and 7° of IV and 1° and 2° of V of article 20 are the appropriate response to the seriousness of the breaches found, provided that the administrative fine incurred, mentioned in 7° of IV and 3° of V of that article 20, does not exceed €20,000 and that the penalty payment incurred, mentioned in 2° of IV and V of that article 20, does not exceed €100 per day of delay from the date set by the decision. Where the total worldwide annual turnover of the controller for the previous financial year exceeds €50 million, these amounts are raised to a €100,000 fine and a €500 per day penalty payment respectively. > > Source: [Loi n° 78-17 du 6 janvier 1978, art. 22-1, al. 2 (French Data Protection Act, version in force since 28 May 2026)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054142442) So there are three possible measures: a reprimand, an injunction (possibly with a penalty payment) and a fine. The procedure is in writing: the organisation receives a report, has one month to respond and can ask to be heard ([CNIL, simplified procedure](https://www.cnil.fr/fr/la-procedure-de-sanction-simplifiee), in French). It is only open to cases with no particular difficulty, in light of established case law or the simplicity of the facts. What the 62 simplified-procedure fines of 2025 on the CNIL’s list show (our count): - they range from €2,000 to €20,000, with a median of €7,000; - 24 are €5,000 or less, typically for a single breach (cookies, failure to cooperate); - 12 hit the €20,000 cap, ten of them for a combination of breaches: video surveillance, record of processing, security, processors. In other words, the amount tracks the number of breaches far more than the size of the business. That does not stop the CNIL from sending a retailer before the restricted committee: on 4 September 2025, a large retailer received €75,000 and an injunction over its video surveillance, outside the simplified procedure. ## What is the maximum GDPR fine in France? **The general cap is €10 million or 2% of worldwide annual turnover, rising to €20 million or 4% for the GDPR’s principles, individuals’ rights, transfers and failure to comply with an order, whichever amount is higher.** These caps apply before the restricted committee ([art. 20 of the French Data Protection Act](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049578536), [GDPR, Article 83](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)). The GDPR caps are the same in every EU member state. What is French-specific is the simplified procedure and its €20,000 cap, the publication rules, and the fact that cookie breaches fall under French law (article 82 of the Act), with caps set by article 20. | Case | Maximum fine | Maximum penalty payment | Legal basis | |---|---|---|---| | Simplified procedure, turnover up to €50m | €20,000 | €100 per day | Loi 78-17, art. 22-1 | | Simplified procedure, turnover above €50m | €100,000 | €500 per day | Loi 78-17, art. 22-1 | | Restricted committee: security, record of processing, processors, data breach, DPIA, DPO | €10m or 2% of worldwide turnover | €100,000 per day | Loi 78-17, art. 20; GDPR, Art. 83(4) | | Restricted committee: cookies and other trackers (art. 82 of the Act) | €10m or 2% of worldwide turnover | €100,000 per day | Loi 78-17, art. 20 | | Restricted committee: principles, legal basis, consent, individuals’ rights, transfers | €20m or 4% of worldwide turnover | €100,000 per day | Loi 78-17, art. 20; GDPR, Art. 83(5) | | Failure to comply with an order from the authority | €20m or 4% of worldwide turnover | €100,000 per day | GDPR, Art. 83(6) | | Processing carried out by the State | No fine | No penalty payment | Loi 78-17, art. 20 | The last row explains why a government ministry received a reprimand and an injunction rather than a fine on 12 March 2026. Other public bodies, on the other hand, are sanctioned like companies: France Travail is one example, as are a municipality and two universities under the simplified procedure in 2025. To set the amount, the restricted committee applies the criteria of Article 83 of the GDPR. Those that recur in the 2025-2026 press releases: seriousness of the breach, number of people affected, sensitivity of the data, an earlier formal notice, the company’s financial capacity, and compliance work done during the procedure. ## How does a CNIL sanction procedure work? **A procedure starts with a trigger (complaint, inspection priority, press coverage, a European authority), usually followed by an inspection, and ends in closure, a reminder of obligations, a formal notice or sanction proceedings.** A formal notice is not a mandatory step: the CNIL’s chair can refer a case straight to the restricted committee. ```mermaid flowchart TD A["Complaint, online or on-site inspection"] --> B{"Breach found?"} B -->|No| C["Case closed"] B -->|Yes| D["Reminder of obligations or formal notice"] B -->|Serious or repeated| F{"Straightforward case?"} D --> E{"Compliant within the deadline?"} E -->|Yes| C E -->|No| F F -->|Yes| G["Simplified procedure: €20,000 max, not public"] F -->|No| H["Restricted committee: up to €20m or 4%"] ``` The steps, based on the [enforcement chain described by the CNIL](https://www.cnil.fr/fr/la-chaine-repressive-de-la-cnil) (in French) and article 20 of the Act: 1. **The trigger**: a complaint from a customer or employee, a priority inspection theme, a press article, an alert from another European authority. The Samaritaine department store was [inspected after a press article and a complaint](https://www.cnil.fr/en/hidden-cameras-cnil-sanctions-samaritaine) about cameras disguised as smoke detectors. 2. **The inspection**: on site, online, by summons or on documents. 3. **The follow-up**: if there is no breach, the case is closed. Otherwise, the chair can remind the organisation of its obligations or serve a formal notice to comply within a deadline they set, which cannot be less than 10 days, or as little as 24 hours in an emergency ([CNIL, formal notice](https://www.cnil.fr/fr/la-procedure-de-mise-en-demeure), in French). A formal notice is not a sanction. 4. **The sanction**: the chair refers the case to the restricted committee (ordinary, adversarial procedure) or opens the simplified procedure. A track record weighs heavily: the publisher of vanityfair.fr, served with a formal notice in 2021, was inspected again in 2023 and 2025, then [fined €750,000](https://www.cnil.fr/en/cookies-placed-without-consent-company-publishes-website-vanityfairfr-fined-750000-euros) on 20 November 2025, the CNIL noting that this formal notice [“should have led it to bring itself into compliance”](https://www.cnil.fr/fr/cookies-deposes-sans-consentement-la-cnil-sanctionne-la-societe-editrice-du-site-vanityfairfr) (in French). **The trap: not answering the CNIL** Answering the CNIL is a legal obligation (article 18 of the French Data Protection Act), and silence is fined separately. In 2025, 14 organisations were sanctioned for failing to cooperate, including doctors and lawyers: two doctors and a lawyer each received a €3,000 fine, with an injunction. When the injunction is ignored, the penalty payment is liquidated: €1,000 each for a doctor and a lawyer on 5 February 2026, €5,100 for an association on 5 March 2026. A letter from the CNIL, even about a simple data access complaint, always calls for an answer within the deadline it sets. ## Are CNIL fines made public? **A sanction under the simplified procedure is never published and the organisation is never named; a restricted committee sanction can be made public, with or without the company’s name.** In 2025, 10 of the 83 sanctions were published. Article 22-1 of the Act forbids the decision-maker under the simplified procedure from “making public the decisions they take”. Before the restricted committee, publication is decided case by case, as [article 22](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054928123) allows. The restricted committee sometimes publishes without naming: the tertiary sector company fined €3.5 million on 30 December 2025 for passing its loyalty programme data to a social network [was not named](https://www.cnil.fr/en/transfer-data-social-network-advertising-purposes-cnil-imposed-fine-eu35-million), the CNIL judging that the point was to inform the public about a widespread practice. For a small business, the reputational risk under the simplified procedure is therefore limited. The financial and practical risk is not: an injunction with a penalty payment forces you to fix the problem by a set date, and the penalty is liquidated if nothing changes. ## How do I avoid a CNIL fine? **Most fines in 2025-2026 punish basic obligations: cookie consent, access security, answering requests, informing individuals and retention periods.** Fixing them costs far less than a procedure, even a simplified one. **Avoid the 5 most-fined breaches** - [ ] **Cookies**: no advertising or non-exempt measurement tracker before the visitor chooses, a “Reject all” button as easy as “Accept all”, and a refusal that is actually respected ([art. 82 of the French Data Protection Act](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978)) - [ ] **Security**: strong passwords, one account per user (no shared accounts), stronger authentication for remote access, and notification to the CNIL within 72 hours of a data breach that poses a risk to individuals (GDPR, Articles 32 and 33) - [ ] **Individuals’ rights and the CNIL**: answer access, erasure or objection requests within one month (GDPR, Article 12(3)), and any letter from the CNIL within the deadline it sets - [ ] **Information**: a complete, up-to-date [privacy policy](/en/guides/privacy-policy-france/), and information signs wherever cameras are filming - [ ] **Retention and documentation**: a set period for each category of data, applied in practice, and a [record of processing](/en/guides/gdpr-record-of-processing/) that documents it; for email or text marketing to consumers, prior consent you can prove ([art. L. 34-5 of the « Code des postes et des communications électroniques »](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000042155961), the Postal and Electronic Communications Code) Two points deserve particular attention for retailers and SMEs with staff. First, video surveillance: the CNIL stresses that continuously filming employees at their workstations, without exceptional circumstances, breaches the data minimisation principle, and video surveillance tops the themes the CNIL cites for the [2026 simplified sanctions](https://www.cnil.fr/fr/23-nouvelles-sanctions-simplifiees) (in French). Second, processors: Article 28 of the GDPR requires a contract with every provider that processes your data on your behalf (host, payroll software, agency), and the processor-contract breach appears in four of the €20,000 simplified-procedure fines imposed in 2025. **With Legalnest**: Legalnest’s **compliance score** includes a “GDPR” framework that tracks the core GDPR documents: **record of processing, data processing agreement (DPA), data breach procedure and retention policy**, plus the appointment of a DPO (self-declared). Each document is generated through a questionnaire and goes back to “to review” 12 months after its last review. The score reflects the status of your documents in Legalnest, recalculated every night; it does not scan your site. [See the plans](/en/pricing/). For a quick health check, the [free website audit](https://app.legalnest.io/tools/website-audit?lang=en) checks the legal links on your home page, HTTPS and whether a consent mechanism is present, and the [website compliance quiz](/en/guides/website-compliance-quiz/) runs through the other obligations. Your [legal notice](/en/guides/legal-notice-website-france/) (« mentions légales ») and [terms of sale](/en/guides/terms-of-sale-france/) (« CGV ») are not the CNIL’s business, but they sit on the same home page as your cookie banner: you may as well check everything in one go. ## Should a small business be worried about CNIL fines? **Giant fines make the headlines, but 67 of the 83 sanctions in 2025 went through the simplified procedure, for simple breaches and amounts of a few thousand euros.** The real risk for a small business is not an eight-figure fine: it is an online check of its cookies, a complaint from a customer or former employee asking for their data, or a CNIL letter left unanswered. Three habits cover most of what was sanctioned: a cookie banner that genuinely lets people refuse, protected access to your systems, and an answer to every request within the month. The rest (record of processing, retention periods, contracts with providers) is documented once, then reviewed once a year. ## Frequently asked questions ### What is the maximum CNIL fine? The cap is €20 million or 4% of total worldwide annual turnover for the previous financial year, whichever is higher, for breaches of the GDPR’s principles, individuals’ rights or transfer rules, or for failure to comply with an order from the authority (GDPR, Article 83(5) and 83(6)). Other breaches, such as security, the record of processing or cookies, are capped at €10 million or 2%. The largest CNIL fine of 2025-2026 is Google’s: €325 million, on 1 September 2025. ### How much can the CNIL fine a small business? Most small organisations are sanctioned under the simplified procedure, where the fine cannot exceed €20,000 when worldwide turnover is below €50 million (art. 22-1 of the French Data Protection Act). In 2025, the 62 simplified-procedure fines in the CNIL’s list ranged from €2,000 to €20,000, with a median of €7,000. The general caps of €10 million or €20 million remain possible if the case goes before the restricted committee. ### Can the CNIL fine a company without a formal notice first? Yes. Article 20 of the French Data Protection Act lets the CNIL’s chair refer a case to the restricted committee “where appropriate” after a formal notice: it is not a mandatory step. In practice, an earlier formal notice weighs on the amount: the publisher of vanityfair.fr, served with one in 2021, was fined €750,000 in November 2025 after new inspections, and the CNIL took that history into account. ### Are CNIL fines made public? Under the simplified procedure, never: the law forbids publishing the decision or naming the organisation. Before the restricted committee, publication is decided case by case (art. 22 of the French Data Protection Act): in 2025, 10 of the 83 sanctions were made public, sometimes without naming the company. ### What happens if I ignore a letter from the CNIL? Failing to cooperate is sanctioned in its own right, because answering the CNIL is a legal obligation (art. 18 of the French Data Protection Act). In 2025, 14 organisations, including doctors and lawyers, were sanctioned for it, often with a fine plus an injunction with a penalty payment. When the injunction is ignored, the penalty payment is liquidated: €1,000 each for a doctor and a lawyer in February 2026, for example. ### How many sanctions did the CNIL impose in 2025? The CNIL imposed 83 sanctions in 2025, totalling €486,839,500 in fines: 16 by the restricted committee and 67 under the simplified procedure. It also issued 143 formal notices, 31 reminders of legal obligations and 2 warnings, 259 decisions in all. ## Sources - [Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (French Data Protection Act), art. 20 (corrective measures and maximum fines)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000049578536) (Légifrance) - [Loi n° 78-17 du 6 janvier 1978, art. 22-1 (simplified procedure), as amended by loi n° 2026-403 du 26 mai 2026, in force since 28 May 2026](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054142442) (Légifrance) - [Loi n° 78-17 du 6 janvier 1978, art. 22 (publication of sanctions)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000054928123) (Légifrance) - [Loi n° 78-17 du 6 janvier 1978, art. 82 (cookies and other trackers)](https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978) (Légifrance) - [La loi Informatique et Libertés (French Data Protection Act, consolidated text: art. 18, 19, 20 and 22-1, in French)](https://www.cnil.fr/fr/la-loi-informatique-et-libertes) (CNIL) - [Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation), Articles 12, 32, 33 and 83](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) (EUR-Lex) - [Code des postes et des communications électroniques (Postal and Electronic Communications Code), art. L. 34-5 (electronic direct marketing)](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000042155961) (Légifrance) - [Les sanctions prononcées par la CNIL (the CNIL’s list of sanctions, updated on 14 April 2026, in French)](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil) (CNIL) - [Sanctions and corrective measures: the CNIL’s actions in 2025](https://www.cnil.fr/en/sanctions-and-corrective-measures-cnils-actions-2025) (CNIL) - [La CNIL a prononcé 23 nouvelles sanctions depuis janvier au titre de la procédure simplifiée (23 new simplified-procedure sanctions since January, in French)](https://www.cnil.fr/fr/23-nouvelles-sanctions-simplifiees) (CNIL) - [La procédure de sanction simplifiée (the simplified sanction procedure, in French)](https://www.cnil.fr/fr/la-procedure-de-sanction-simplifiee) (CNIL) - [La procédure de mise en demeure (the formal notice procedure, in French)](https://www.cnil.fr/fr/la-procedure-de-mise-en-demeure) (CNIL) - [La chaîne répressive de la CNIL (the CNIL’s enforcement chain, in French)](https://www.cnil.fr/fr/la-chaine-repressive-de-la-cnil) (CNIL) - [Cookies and advertisements inserted between emails: Google fined 325 million euros by the CNIL](https://www.cnil.fr/en/cookies-and-advertisements-inserted-between-emails-google-fined-325-million-euros-cnil) (CNIL) - [Cookies placed without consent: SHEIN fined 150 million euros by the CNIL](https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil) (CNIL) - [Data breach: FREE MOBILE and FREE fined €42 million](https://www.cnil.fr/en/sanction-free-2026) (CNIL) - [Data breach: FRANCE TRAVAIL fined €5 million](https://www.cnil.fr/en/data-breach-5million-fine-france-travail) (CNIL) - [Health data: fine of 5 million euros against IQVIA](https://www.cnil.fr/en/health-data-fine-5-million-euros-against-iqvia) (CNIL) - [Health data breach: EUR 500,000 fine against HÔPITAL PRIVÉ DE LA LOIRE](https://www.cnil.fr/en/sanction-fine-hopital-prive-loire) (CNIL) - [Failure to respect the rights of individuals: EUR 300,000 fine against EXTIA](https://www.cnil.fr/en/sanction-failure-rights-individuals-extia) (CNIL) - [Cookies: AMERICAN EXPRESS fined €1.5 million by the CNIL](https://www.cnil.fr/en/cookies-american-express-fined-eu15-million-cnil) (CNIL) - [Cookies placed without consent: the company that publishes the website “vanityfair.fr” fined 750,000 euros by the CNIL](https://www.cnil.fr/en/cookies-placed-without-consent-company-publishes-website-vanityfairfr-fined-750000-euros) (CNIL) - [Cookies déposés sans consentement : la CNIL sanctionne la société éditrice du site « vanityfair.fr » d’une amende de 750 000 euros (vanityfair.fr press release, in French)](https://www.cnil.fr/fr/cookies-deposes-sans-consentement-la-cnil-sanctionne-la-societe-editrice-du-site-vanityfairfr) (CNIL) - [Data brokers: SOLOCAL MARKETING SERVICES fined €900,000](https://www.cnil.fr/en/data-brokers-solocal-marketing-services-fined-eu900000) (CNIL) - [Data brokers: CALOGA fined €80,000](https://www.cnil.fr/en/data-brokers-caloga-fined-eu80000) (CNIL) - [Hidden cameras: the CNIL sanctions the SAMARITAINE](https://www.cnil.fr/en/hidden-cameras-cnil-sanctions-samaritaine) (CNIL) - [Data breach: MOBIUS SOLUTIONS LTD fined €1 million](https://www.cnil.fr/en/data-breach-mobius-solutions-ltd-fined-eu1-million) (CNIL) - [Data security: NEXPUBLICA FRANCE fined €1,700,000](https://www.cnil.fr/en/data-security-nexpublica-france-fined-eur1700000) (CNIL) - [Transfer of data to a social network for advertising purposes: the CNIL imposed a fine of €3.5 million](https://www.cnil.fr/en/transfer-data-social-network-advertising-purposes-cnil-imposed-fine-eu35-million) (CNIL) - [Clôture de l’injonction prononcée à l’encontre de la société SOLOCAL MARKETING SERVICES (closure of the injunction against Solocal Marketing Services, in French)](https://www.cnil.fr/fr/cloture-injonction-solocal-marketing-services) (CNIL) - [Closure of the order issued against KASPR](https://www.cnil.fr/en/closure-order-issued-against-kaspr) (CNIL) - [Automated decisions: UBER fined nearly EUR 825 million](https://www.cnil.fr/en/automated-decisions-uber-fined-nearly-eur-825-million) (CNIL) - [Délibération de la formation restreinte n° SAN-2025-001 du 15 mai 2025 (Solocal Marketing Services; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051630617) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-002 du 15 mai 2025 (Caloga; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051660380) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-004 du 1er septembre 2025 (Google LLC and Google Ireland Limited; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182222) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-005 du 1er septembre 2025 (Infinite Styles Services Co. Limited; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182271) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-008 du 18 septembre 2025 (Samaritaine; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052266505) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-010 du 20 novembre 2025 (Les Publications Condé Nast; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052851847) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-011 du 27 novembre 2025 (American Express Carte France; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-014 du 11 décembre 2025 (Mobius Solutions Ltd; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053048614) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-015 du 22 décembre 2025 (Nexpublica France; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053151799) (Légifrance) - [Délibération de la formation restreinte n° SAN-2025-017 du 30 décembre 2025 (CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053391342) (Légifrance) - [Délibération de la formation restreinte n° SAN-2026-001 du 8 janvier 2026 (Free Mobile; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053352664) (Légifrance) - [Délibération de la formation restreinte n° SAN-2026-002 du 8 janvier 2026 (Free; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053352643) (Légifrance) - [Délibération de la formation restreinte n° SAN-2026-003 du 22 janvier 2026 (France Travail; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053408671) (Légifrance) - [Délibération de la formation restreinte n° SAN-2026-008 du 26 mai 2026 (IQVIA Operations France; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054136834) (Légifrance) - [Délibération de la formation restreinte n° SAN-2026-009 du 21 juillet 2026 (Hôpital privé de la Loire; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054790100) (Légifrance) - [Délibération de la formation restreinte n° SAN-2026-010 du 21 juillet 2026 (Extia; CNIL restricted committee decision, in French)](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054810440) (Légifrance)