CNIL fines 2025-2026: every penalty, and what they mean for small businesses

In 2025, the CNIL (the « Commission nationale de l’informatique et des libertés », France’s data protection authority) imposed €486,839,500 in fines, and almost 98% of that sum comes from two decisions of 1 September: €325 million for Google, €150 million for SHEIN. The rest tells a different story. Of the year’s 83 sanctions, 67 were imposed under the simplified procedure, on the likes of a convenience store, a GP, a travel agency, an online shop or a parliamentary candidate. The median amount of those fines, by our count of the official list: €7,000.

That second story is the one that matters if you run a French company or sell to French customers. This guide lists every 2025 and 2026 sanction that can be checked on cnil.fr and Légifrance (France’s official legal database), then pulls out what counts for a small business: what actually gets fined, how much, and how the procedure works.

How much did the CNIL fine companies in 2025?

In 2025, the CNIL imposed 83 sanctions totalling €486,839,500 in fines, €475 million of it from the Google and SHEIN decisions alone. The 67 simplified-procedure sanctions, reserved for straightforward cases, are capped at €20,000 each.

The key figures from the review published on 9 February 2026:

The 83 sanctions break down into 78 fines (27 of them with an injunction backed by a penalty payment), three liquidated penalty payments and two reprimands (« rappels à l’ordre »). All fines are collected by the French Treasury.

2026 began with a bang. On 8 January, Free Mobile and Free were hit with €42 million in fines after a breach affecting 24 million subscriber contracts, followed by France Travail, €5 million, on 22 January and IQVIA, €5 million, on 26 May. At the small end, the CNIL announced on 6 July 2026 23 simplified sanctions since January (in French), €133,750 in total.

Which companies has the CNIL fined in 2025 and 2026?

The table below covers the 99 decisions on the CNIL’s official list, from 9 January 2025 to 2 April 2026 (list updated on 14 April 2026), plus the three sanctions published since. Organisations sanctioned under the simplified procedure are never named: the law forbids it.

How to read it: “simplified” marks a decision taken by a single member of the restricted committee (« formation restreinte », the CNIL body that imposes sanctions), capped at €20,000 (€100,000 since 28 May 2026 for an organisation whose worldwide turnover exceeds €50 million); the other rows are restricted committee decisions. The link goes to the decision on Légifrance when it has been published, otherwise to the CNIL’s list (in French: the table follows the French version of the list). Of the 23 simplified sanctions announced for January to July 2026, 12 are detailed here; the CNIL has not yet published the details of the others, so they are not listed row by row. Type “cookies”, “distance selling” or “doctor” in the filter.

Closures of injunctions (KASPR in March 2026, Solocal in September 2026, in French) are not sanctions and are not listed. Nor is the €824,990,000 fine on Uber, announced by the CNIL on 24 August 2026: it was imposed by the Dutch data protection authority, in cooperation with the CNIL.

What are the most common reasons for CNIL fines?

Cookies, data security, ignoring individuals’ rights, failing to answer the CNIL and video surveillance of employees were the most frequent grounds for sanctions in 2025. Information given to individuals and retention periods also come up in a large share of cases.

The first six rows come from the CNIL’s 2025 review; the last two from our count of the “main breaches” in its list of sanctions (in French). A single decision often covers several breaches.

What stands out in the list is that small organisations are not fined for sophisticated schemes. A distance-selling shop paid €3,000 on 16 October 2025 for a single breach: cookies placed without consent. A sporting goods shop hit the €20,000 cap on 10 April 2025 by combining video surveillance of employees, no record of processing and poor security. A payroll software publisher was fined €15,000 on 15 December 2025 for security alone.

Cookies remain the most visible target, because an online check is enough to spot the problem: the law allows CNIL agents to inspect from the internet, including under an assumed identity (art. 19 of the « loi Informatique et Libertés », the French Data Protection Act, in French). The consent rule itself is EU-wide (it comes from the ePrivacy Directive), but in France it is enforced by the CNIL under article 82 of that Act. In 2026, the CNIL was still fining banners where accepting took one click while refusing meant going through “Customise”. Our guide to a CNIL-compliant cookie banner sets out the rules, and the free cookie checker shows the trackers your site places on first load.

How much can the CNIL fine a small business?

A small business is usually dealt with under the simplified procedure, where the fine cannot exceed €20,000 and the penalty payment €100 per day of delay, as long as its worldwide turnover does not exceed €50 million. Above that threshold, the caps have been €100,000 and €500 per day since 28 May 2026.

So there are three possible measures: a reprimand, an injunction (possibly with a penalty payment) and a fine. The procedure is in writing: the organisation receives a report, has one month to respond and can ask to be heard (CNIL, simplified procedure, in French). It is only open to cases with no particular difficulty, in light of established case law or the simplicity of the facts.

What the 62 simplified-procedure fines of 2025 on the CNIL’s list show (our count):

• they range from €2,000 to €20,000, with a median of €7,000;
• 24 are €5,000 or less, typically for a single breach (cookies, failure to cooperate);
• 12 hit the €20,000 cap, ten of them for a combination of breaches: video surveillance, record of processing, security, processors.

In other words, the amount tracks the number of breaches far more than the size of the business. That does not stop the CNIL from sending a retailer before the restricted committee: on 4 September 2025, a large retailer received €75,000 and an injunction over its video surveillance, outside the simplified procedure.

What is the maximum GDPR fine in France?

The general cap is €10 million or 2% of worldwide annual turnover, rising to €20 million or 4% for the GDPR’s principles, individuals’ rights, transfers and failure to comply with an order, whichever amount is higher. These caps apply before the restricted committee (art. 20 of the French Data Protection Act, GDPR, Article 83).

The GDPR caps are the same in every EU member state. What is French-specific is the simplified procedure and its €20,000 cap, the publication rules, and the fact that cookie breaches fall under French law (article 82 of the Act), with caps set by article 20.

The last row explains why a government ministry received a reprimand and an injunction rather than a fine on 12 March 2026. Other public bodies, on the other hand, are sanctioned like companies: France Travail is one example, as are a municipality and two universities under the simplified procedure in 2025.

To set the amount, the restricted committee applies the criteria of Article 83 of the GDPR. Those that recur in the 2025-2026 press releases: seriousness of the breach, number of people affected, sensitivity of the data, an earlier formal notice, the company’s financial capacity, and compliance work done during the procedure.

How does a CNIL sanction procedure work?

A procedure starts with a trigger (complaint, inspection priority, press coverage, a European authority), usually followed by an inspection, and ends in closure, a reminder of obligations, a formal notice or sanction proceedings. A formal notice is not a mandatory step: the CNIL’s chair can refer a case straight to the restricted committee.

flowchart TD
  A["Complaint, online or on-site inspection"] --> B{"Breach found?"}
  B -->|No| C["Case closed"]
  B -->|Yes| D["Reminder of obligations or formal notice"]
  B -->|Serious or repeated| F{"Straightforward case?"}
  D --> E{"Compliant within the deadline?"}
  E -->|Yes| C
  E -->|No| F
  F -->|Yes| G["Simplified procedure: €20,000 max, not public"]
  F -->|No| H["Restricted committee: up to €20m or 4%"]

The steps, based on the enforcement chain described by the CNIL (in French) and article 20 of the Act:

1. The trigger: a complaint from a customer or employee, a priority inspection theme, a press article, an alert from another European authority. The Samaritaine department store was inspected after a press article and a complaint about cameras disguised as smoke detectors.
2. The inspection: on site, online, by summons or on documents.
3. The follow-up: if there is no breach, the case is closed. Otherwise, the chair can remind the organisation of its obligations or serve a formal notice to comply within a deadline they set, which cannot be less than 10 days, or as little as 24 hours in an emergency (CNIL, formal notice, in French). A formal notice is not a sanction.
4. The sanction: the chair refers the case to the restricted committee (ordinary, adversarial procedure) or opens the simplified procedure. A track record weighs heavily: the publisher of vanityfair.fr, served with a formal notice in 2021, was inspected again in 2023 and 2025, then fined €750,000 on 20 November 2025, the CNIL noting that this formal notice “should have led it to bring itself into compliance” (in French).

Are CNIL fines made public?

A sanction under the simplified procedure is never published and the organisation is never named; a restricted committee sanction can be made public, with or without the company’s name. In 2025, 10 of the 83 sanctions were published.

Article 22-1 of the Act forbids the decision-maker under the simplified procedure from “making public the decisions they take”. Before the restricted committee, publication is decided case by case, as article 22 allows. The restricted committee sometimes publishes without naming: the tertiary sector company fined €3.5 million on 30 December 2025 for passing its loyalty programme data to a social network was not named, the CNIL judging that the point was to inform the public about a widespread practice.

For a small business, the reputational risk under the simplified procedure is therefore limited. The financial and practical risk is not: an injunction with a penalty payment forces you to fix the problem by a set date, and the penalty is liquidated if nothing changes.

How do I avoid a CNIL fine?

Most fines in 2025-2026 punish basic obligations: cookie consent, access security, answering requests, informing individuals and retention periods. Fixing them costs far less than a procedure, even a simplified one.

Two points deserve particular attention for retailers and SMEs with staff. First, video surveillance: the CNIL stresses that continuously filming employees at their workstations, without exceptional circumstances, breaches the data minimisation principle, and video surveillance tops the themes the CNIL cites for the 2026 simplified sanctions (in French). Second, processors: Article 28 of the GDPR requires a contract with every provider that processes your data on your behalf (host, payroll software, agency), and the processor-contract breach appears in four of the €20,000 simplified-procedure fines imposed in 2025.

For a quick health check, the free website audit checks the legal links on your home page, HTTPS and whether a consent mechanism is present, and the website compliance quiz runs through the other obligations. Your legal notice (« mentions légales ») and terms of sale (« CGV ») are not the CNIL’s business, but they sit on the same home page as your cookie banner: you may as well check everything in one go.

Should a small business be worried about CNIL fines?

Giant fines make the headlines, but 67 of the 83 sanctions in 2025 went through the simplified procedure, for simple breaches and amounts of a few thousand euros. The real risk for a small business is not an eight-figure fine: it is an online check of its cookies, a complaint from a customer or former employee asking for their data, or a CNIL letter left unanswered.

Three habits cover most of what was sanctioned: a cookie banner that genuinely lets people refuse, protected access to your systems, and an answer to every request within the month. The rest (record of processing, retention periods, contracts with providers) is documented once, then reviewed once a year.