Cookie banner in France: CNIL rules, traps and real fines in 2026

On 16 October 2025, a distance-selling shop was fined €3,000 over its cookies by the CNIL (the « Commission nationale de l’informatique et des libertés », France’s data protection authority). You will never know which one: under the simplified procedure, the CNIL does not publish the names of the companies it fines. Six weeks earlier, on 1 September 2025, SHEIN was fined €150 million for trackers placed before the visitor clicked anything and a “Reject all” button that did not stop new trackers being placed. Between those two extremes the rules are the same, and they fit in a few lines.

Is a cookie banner mandatory in France?

The banner itself is not mandatory: what is mandatory is the visitor’s prior consent before any non-exempt tracker is stored or read. As soon as your site uses advertising, a social media pixel or Google Analytics in its standard configuration, you need a consent mechanism, and a banner is the most common form.

The principle is EU-wide: it comes from Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC), which each member state writes into its own law. In France, that is article 82 of the « loi Informatique et Libertés » (French Data Protection Act). What this guide describes on top of it is French: the CNIL’s guidelines, recommendation and FAQ, and the fines it imposes.

Three takeaways from this text. It covers any “tracker”, not just cookies: pixels, browser local storage, device fingerprinting and advertising identifiers are all included, as the CNIL points out (in French). It applies whether or not the data is personal (CNIL FAQ, question 8, in French). And after a refusal or withdrawal, the publisher must stop all reading and writing from its site, including by partners whose tags it has embedded (question 29).

The CNIL set out how to apply this article in two texts adopted on 17 September 2020: the guidelines (deliberation n° 2020-091), which restate the law, and the recommendation (deliberation n° 2020-092), a non-binding practical guide whose consolidated version was published on 16 January 2026 after an amendment on multi-device consent (deliberation n° 2025-131 of 18 December 2025). Both are in French.

Which cookies are exempt from consent in France?

Trackers strictly necessary for the service the visitor asked for are exempt: shopping basket, authentication, remembering the cookie choice, load balancing, expected interface personalisation and, under strict conditions, audience measurement. Everything else (advertising, retargeting, social sharing, embedded videos, tools that reuse the data) requires prior consent.

The list comes from the CNIL’s compliance page and its cookie FAQ, updated on 29 April 2026 (both in French).

The diagram below sums up the reasoning, tracker by tracker.

flowchart TD
  A["A tracker reads or writes on the visitor’s device"] --> B{"Basket, login, cookie choice, security?"}
  B -->|Yes| X["Exempt: informing users recommended"]
  B -->|No| C{"Used to measure audience?"}
  C -->|No| Y["Prior consent required"]
  C -->|Yes| D{"For you only, anonymous stats, no cross-site tracking?"}
  D -->|No| Y
  D -->|Yes| E{"Provider does not reuse data for itself?"}
  E -->|Yes| Z["Exempt: inform and allow objection"]
  E -->|No| Y

Is Google Analytics exempt from cookie consent in France?

No, not in its standard configuration: the CNIL names Google Analytics among the offers that fall outside the exemption, because the provider reuses the data for its own purposes. Only an audience measurement tool configured to meet every condition of the exemption can do without consent.

Those conditions are set out on the CNIL’s page on audience measurement (in French, published on 4 July 2025): a purpose limited to measuring the site’s audience exclusively on the publisher’s behalf, anonymous statistics only, no cross-referencing with other processing, no transfer of non-anonymous data to third parties, no tracking of browsing on other sites or apps. The CNIL also recommends a tracker lifetime of thirteen months with no automatic extension, and data retention of twenty-five months at most.

On Google Analytics specifically, its page « Mesurer la fréquentation de vos sites web » (measuring traffic on your websites, in French) recalls that its restricted committee (the CNIL body that imposes sanctions) ruled in decision SAN-2020-008 of 18 November 2020 that these cookies “are not strictly necessary for the provision of the service”.

The CNIL no longer publishes a list of exempt tools: it has replaced it with a self-assessment tool for providers (FAQ, question 12) and, in an inspection, it will check the actual configuration; both the publisher and the provider can be held liable. In practice, if you cannot show that your tool ticks every box, put it behind consent.

What must a CNIL-compliant cookie banner include?

A compliant banner states the purposes and the companies involved, collects a clear affirmative action, lets visitors refuse as easily as they accept from the first screen, and lets them withdraw their choice at any time. Before any click, no tracker that needs consent may be placed.

The requirements, drawn from the CNIL’s guidelines, recommendation and FAQ:

• Nothing before the choice. Advertising cookies placed “as soon as they arrived on the site” were the first breach in both the SHEIN and vanityfair.fr decisions.
• Purposes on the first layer, in plain words (“Personalised advertising”, “Audience measurement”), with a link to the up-to-date list of companies that place trackers.
• A clear affirmative action. Continuing to browse is not consent: the CNIL treats it as a refusal (FAQ, question 19). Closing the banner is not acceptance either.
• Refusing as easily as accepting. A “Reject all” button on the first layer, looking the same as “Accept all”, is expected, or failing that an equally simple way to refuse (question 37). A refusal available only on the second layer, behind “Settings”, is not good enough (question 38).
• No deceptive design: a greyed-out or smaller reject button, or wording that suggests consent is compulsory.
• A choice per purpose, at least on a second layer: advertising, audience measurement, social media.
• Withdrawal at any time, through a “Manage my cookies” link in the footer or a permanent icon. Withdrawal must actually work: after a refusal, no more reading or writing of the trackers concerned, third-party ones included (question 29).

A “Continue without accepting” link is still allowed. On 19 June 2026, the Conseil d’État (n° 501417) (France’s highest administrative court, decision in French) dismissed an association’s request to remove from the recommendation the example of a banner with that link in the top right corner: it held that refusal was available on the same screen and with the same ease.

Your banner does not live on its own: your privacy policy and your cookie policy must describe the same trackers, the same purposes and the same retention periods.

How long should cookie consent last in France?

The CNIL considers six months, for consent and refusal alike, to be generally appropriate. It is good practice, not a legal deadline: the period is assessed case by case, but asking again at every visit after a refusal weighs on the freedom of choice.

The CNIL’s compliance page and its FAQ (question 21) both use these six months. Do not confuse this period with the lifetime of exempt audience measurement cookies (thirteen months) or with the retention of the data they collect (twenty-five months).

How do I prove cookie consent?

Whoever relies on consent must be able to prove it, at any time. The CNIL suggests several non-exclusive methods: time-stamped screenshots of each version of the banner, time-stamped code deposits, third-party audits, and a configuration history kept by the consent management platform provider.

These methods are listed on the CNIL page « Cookies et traceurs : que dit la loi ? » (what the law says, in French). In practice, for a Shopify or WooCommerce store: a dated screenshot of the banner every time it changes, an export of your consent tool’s configuration, and a consent log if your tool provides one.

Are cookie walls allowed in France?

Not banned in principle, but tightly framed: since the Conseil d’État decision of 19 June 2020, the CNIL assesses case by case whether a visitor who refuses has a real and fair alternative. For an online shop, blocking access to the catalogue until advertising is accepted is very hard to justify.

The criteria published by the CNIL on 16 May 2022 (in French): a real and fair alternative to access the content without trackers, offered by the publisher itself or, failing that, whose existence it can show on another publisher’s site; if that alternative is paid, a reasonable price the publisher must be able to justify; a wall limited to the purposes that fund the service (targeted advertising, not editorial personalisation); and, for those who choose paid access, no trackers that need consent.

Is Google Consent Mode enough to be compliant?

No: Consent Mode collects no consent at all, it passes the choice made in your banner on to Google tags. You still need a compliant banner, and “advanced” mode, which sends requests to Google before any choice is made, calls for caution.

According to Google’s documentation, it is the publisher’s job to obtain consent, through a banner or a consent management platform. In “basic” mode, Google tags stay blocked until the user interacts with the banner, and nothing is sent if they refuse. In “advanced” mode, tags load as soon as the page opens and, while consent is refused, send Google “cookieless” pings (timestamp, browser, referring page, consent status).

Neither the CNIL’s cookie FAQ nor its guidelines mention Consent Mode. But article 82 covers any access to information on the device, not just cookies, and the European Data Protection Board’s Guidelines 2/2023, EU-level guidance, extend the rule to pixel and URL-based tracking. With no official position on these pings, basic mode is the safer choice.

What are the fines for a non-compliant cookie banner in France?

The legal maximum for a breach of article 82 is €10 million or 2% of annual worldwide turnover, whichever is higher. Straightforward cases go through the simplified procedure, capped at €20,000 for most companies and with no name published, and the CNIL uses it regularly for cookies.

The maximum is set by article 20 of the French Data Protection Act (in French), which also provides for a penalty payment of up to €100,000 per day of delay. The cap of the simplified procedure rises to €100,000 when worldwide turnover exceeds €50 million. The CNIL’s 2025 review counts 21 organisations sanctioned for breaching the rules on trackers: placing them without consent, insufficient information, refusal or withdrawal not taken into account. By 6 July 2026, the CNIL had issued 23 simplified sanctions since January, €133,750 in total; among the cookie-related breaches, it cites banners where accepting took one click while refusing meant going through “Customise” and then a settings screen.

What these decisions show: online retail appears in most rows, and the detailed decisions always find the same mistakes (trackers before the choice, vague information, refusal ignored). Our guide to CNIL fines explains the procedure, from online inspection to decision.

Do email tracking pixels need consent under the CNIL’s 2026 recommendation?

Since recommendation n° 2026-042, published in the « Journal officiel » (France’s official gazette) on 14 April 2026, the invisible pixel that measures email opens is treated like a cookie: consent in principle, unless its use is strictly limited to measuring the deliverability of an email linked to a service the recipient asked for. The three-month grace period for existing mailing lists expired, in principle, on 14 July 2026.

Deliberation n° 2026-042 was adopted on 12 March 2026, on the basis of the same article 82. According to the CNIL’s presentation page and its Q&A of 22 July 2026 (both in French):

• Deliverability exemption: possible for an email linked to a service requested (order confirmation, subscription renewal, security alert) or an expressly requested newsletter, if the pixel is only used to spot recipients who no longer open your emails so you can remove them from your lists. In principle, only the date of the last open is needed. Abandoned-cart reminders, being promotional, do not qualify.
• Consent required as soon as the pixel is used for anything else: time of opening, personalising sends. Collecting the IP address and anonymising it afterwards is not enough to stay within the exemption. Marketing sent to an existing customer under the “similar products or services” rule is not a requested service: its pixel is not exempt.
• Aggregate statistics: an overall open rate remains possible without consent, from data collected by an exempt pixel and then anonymised.
• Existing lists: for addresses collected before 14 April 2026, recipients had to be clearly informed and allowed to object within three months of publication, around 14 July 2026, a deadline the CNIL accepts may be extended “reasonably” if sending volumes justify it and this is documented. Without that information, you must now collect consent or stop using the pixels concerned.

If your shop sends campaigns through an email marketing tool, check whether open tracking is switched on by default, and add this purpose to your consent collection.

Will the EU Digital Omnibus get rid of cookie banners?

Not today: the European Commission’s proposal of 19 November 2025 is still under discussion, and as of 7 October 2026 article 82 and the CNIL’s rules apply unchanged. Even if adopted as drafted, it would keep the principle of consent.

The proposal COM(2025) 837 would move the rule into a new Article 88a of the GDPR. It would add exemptions, including aggregate audience measurement carried out by the publisher for its own use, require that refusal be possible with a single-click button, ban asking for consent again for at least six months after a refusal, and provide for automated, machine-readable choice signals (Article 88b). According to the European Parliament’s procedure file, the text is awaiting a committee decision. No application date has been set: do not take your banner down.

How do I check my cookie banner in ten minutes?

Open your site in a private window, click nothing, and look at which cookies are already there: that is exactly what the CNIL recorded when it inspected shein.com and vanityfair.fr. Then reject everything, reload, and check that no advertising tracker appears.

For the first point, the free cookie checker reads your home page as the server sends it: it spots known trackers and consent banners, flags those that load without waiting for the visitor’s choice and the cookies set on first load. It does not replace a test in a real browser, because scripts can load others once they run. Like our other free tools, it needs no account.

The banner is only one part of your site: also check your legal notice, your GDPR record of processing if you handle customer data, or take stock in a few questions with the website compliance quiz.