CNIL cookie rules: consent exemptions, the refuse-all button and every major cookie sanction

Quotations from French texts on this page are our translations, with the official French text linked.

The law. Article 82 requires clear and complete information and prior consent for any access to, or storage on, a user's device. Consent is not needed for operations whose "exclusive purpose" is to enable or facilitate electronic communication, or that are "strictly necessary" for a service the user expressly requested (guidelines, paras 3 and 46). The CNIL publishes the text of the law on its own site (CNIL, loi Informatique et Libertés, Article 82).

What the CNIL said. The guidelines read Article 82 with the GDPR definition of consent. Continuing to browse is not consent. Users must be able to withdraw at any time, and whoever uses trackers must be able to prove valid consent (CNIL, guidelines and recommendation page). The recommendation is a practical guide. In the CNIL's words it is "sans toutefois être prescriptive", not prescriptive (CNIL FAQ, updated 29 April 2026).

What a court said. The CNIL's first version of the guidelines, of 4 July 2019, banned cookie walls outright. On 19 June 2020 the Conseil d'État annulled that paragraph: a general ban could not be derived from the requirement of free consent (Conseil d'État, n° 434684). The 2020 guidelines now say a cookie wall "is likely to" undermine free consent "in some cases" and must be judged case by case (para 17). On 16 May 2022 the CNIL published evaluation criteria for such walls (CNIL, 16 May 2022).

The phrase "refuse all" does not appear in Article 82 (CNIL, text of the law). The duty comes in three layers, each with a different legal weight.

1. The guidelines (restating the law). Consent needs a positive act, but refusal "can be inferred from silence". Expressing refusal must need no step at all, or an action with the same simplicity as consent (para 30).
2. The recommendation (an example, not a mandate). The CNIL "strongly recommends" that refusal sit on the same screen with the same ease as consent. Its example is two buttons, "tout accepter" and "tout refuser", at the same level and in the same format (recommendation 2020-092, paras 31 to 32). A "continue without accepting" link or closing the banner can also work if the banner says so (para 33).
3. The sanctions (the rule applied). On 31 December 2021 the CNIL fined Google €150 million and Facebook €60 million because refusing cookies on google.fr, youtube.com and facebook.com took more steps than accepting (CNIL sanctions list; CNIL, 16 May 2023).

Formal notices did most of the work. After the six-month adaptation period ended on 31 March 2021, the CNIL ran 125 online checks and sent 94 formal notices in three waves (CNIL, 16 May 2023). In December 2024 it sent further notices over banners that styled the refusal link to be hard to see, or showed "accept" several times and "refuse" once (CNIL, 12 December 2024).

A button is not enough on its own. In the Shein and Vanity Fair decisions, users clicked "Tout refuser" and new consent-based cookies were still set while existing ones kept being read (CNIL, Shein, 3 September 2025; CNIL, vanityfair.fr, 27 November 2025).

The guidelines list trackers that, "in the current state of practices", may be treated as exempt. The list is open ("notamment") and each item holds only if the tracker serves that purpose alone (guidelines, paras 47 to 49).

Audience measurement: what the CNIL said. A measurement tracker is exempt only if it serves the publisher's own audience measurement, produces anonymous statistics, and does not allow tracking across sites or apps. Data may not be combined with other processing or passed to third parties (guidelines, para 51). The recommendation adds a tracker lifetime such as 13 months, not extended on each visit, and data retention of at most 25 months (recommendation, para 50).

The CNIL's page of 4 July 2025 sharpens the cross-site rule. Any solution that uses one identifier across several sites, for example through a third-party domain, to deduplicate or measure unified reach is excluded (CNIL, 4 July 2025). A processor may sell comparative measurement to several publishers only if each publisher's data and trackers stay fully separate. Offers whose providers reuse data for their own account fall outside the exemption, although some can be configured to stop that reuse.

The same page replaced case-by-case review with a self-assessment tool for vendors. A vendor that meets the criteria may say its tool "can be implemented without consent if correctly configured". It may not call the tool "certified" or "validated by the CNIL" (CNIL, 4 July 2025).

The CNIL's restricted committee (formation restreinte) imposes the fines. The CNIL removes company names from its online list after a publication period, so older rows below rely on the CNIL's announcements and annual reports (CNIL notice). Amounts are as decided; court outcomes are noted where we found them.

Smaller cases run alongside. Between April 2024 and March 2026 the CNIL list shows 25 simplified-procedure decisions citing cookies, each with fines of €20,000 or less (CNIL sanctions list, updated 14 April 2026). The GDPR-based Criteo fine of 2023 concerned proof of consent for targeting and is covered in our guide to GDPR, ePrivacy and RTB consent signals.

What a court said. Yahoo argued that only the Irish authority could act, because Yahoo EMEA is established in Ireland. The Conseil d'État disagreed. The GDPR cooperation mechanism "was not provided for" the enforcement of the ePrivacy Directive, which falls to national authorities (n° 494300, para 9). Yahoo France, which promotes Yahoo's ad products in France, counted as an establishment, so French law applied (para 8).

The CNIL used the same reasoning against Shein's Irish entity, relying on its French subsidiary (CNIL, 3 September 2025). The Yahoo judgment also confirms that a publisher answers for third-party cookies set through its site. It must check that partners do not drop trackers that break the rules (n° 494300, para 15).

This section is our analysis of the decisions above, not a statement of how the CNIL would rule on a new case. The facts that change the answer are the purpose of the tracker, who reads it, and whether the user's refusal stops it.

Three practical consequences follow from the table. A TCF consent string records a choice but does not decide whether reading a device was lawful; the CNIL tests what actually happened in the browser. Our TCF consent string decoder shows what a string records. Server-side setups move calls off the page but not out of scope, as the Fnac decision shows. And user-ID syncing between partners, explained in our guide to Prebid Server cookie sync, is a read-and-write operation that sits on the consent side of the line.

New CNIL guidance. The CNIL published final recommendations on tracking pixels in emails on 14 April 2026 (CNIL, 14 April 2026). On 16 January 2026 it published final recommendations on consent given once for all devices logged into one account, including connected TVs. If consent covers all devices, refusal and withdrawal must have the same scope (CNIL, 16 January 2026). A consultation on session-replay tools opened on 25 February 2026 and is now closed (CNIL, Cookies et traceurs tag).

EU level. The EDPB adopted guidelines on the technical scope of ePrivacy Article 5(3), which the CNIL summarised on 18 November 2024 (CNIL, 18 November 2024). The Council's Digital Omnibus mandate of 21 October 2026 would rewrite Article 5(3) with six consent exemptions and a single-click refusal. It is not law, and Parliament has no position. Our EU Digital Omnibus tracker follows the text and its status.

Elsewhere. Other countries apply Article 5(3) differently; see cookie banner rules by country. The UK replaced its own rule in 2026, covered in the UK Data (Use and Access) Act guide. Our ad tech compliance hub collects the related frameworks.

1. CNIL, Délibération n° 2020-091 du 17 septembre 2020, lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 (cookies et autres traceurs). https://www.cnil.fr/sites/default/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs.pdf
2. CNIL, Délibération n° 2020-092 du 17 septembre 2020, recommandation « cookies et autres traceurs ». https://www.cnil.fr/sites/default/files/atoms/files/recommandation-cookies-et-autres-traceurs.pdf
3. CNIL, « Cookies et autres traceurs : la CNIL publie des lignes directrices modificatives et sa recommandation » (page dated 29 September 2020). https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices-modificatives-et-recommandation
4. CNIL, Questions-réponses sur les lignes directrices modificatives et la recommandation (updated 29 April 2026). https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ
5. CNIL, La loi Informatique et Libertés, Article 82. https://www.cnil.fr/fr/la-loi-informatique-et-libertes#article82
6. CNIL, « Cookies : solutions pour les outils de mesure d'audience » (4 July 2025). https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience
7. CNIL, « Cookie walls : la CNIL publie des premiers critères d'évaluation » (16 May 2022). https://www.cnil.fr/fr/cookie-walls-la-cnil-publie-des-premiers-criteres-devaluation
8. CNIL, « Évolution des pratiques du web en matière de cookies : la CNIL évalue l'impact de son plan d'action » (16 May 2023). https://www.cnil.fr/fr/evolution-des-pratiques-du-web-en-matiere-de-cookies-la-cnil-evalue-limpact-de-son-plan-daction
9. CNIL, « Bannières cookies trompeuses : la CNIL met en demeure des éditeurs de sites web » (12 December 2024). https://www.cnil.fr/fr/bannieres-cookies-trompeuses-la-cnil-met-en-demeure-des-editeurs-de-sites-web
10. CNIL, Les sanctions prononcées par la CNIL (list updated 14 April 2026). https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil