{"page":"/blog/cnil-cookie-rules","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Decision date","Company","Fine","What the CNIL found","Source"],"rows":[["7 Dec 2020","Google LLC and Google Ireland","€60m + €40m","Cookies set without consent; information; right to object. Conseil d'État rejected the appeal on 28 Jan 2022","CNIL list; CE n° 449209"],["7 Dec 2020","Amazon Europe Core","€35m","Cookies set without consent; information. Conseil d'État rejected the appeal on 27 Jun 2022","CE n° 451423"],["31 Dec 2021","Google","€150m","Refusing cookies harder than accepting","CNIL list; Légifrance"],["31 Dec 2021","Facebook","€60m","Same refusal design, plus information","Légifrance; CNIL, 16 May 2023"],["19 Dec 2022","Microsoft Ireland Operations","€60m","bing.com: consent not properly collected; refusal not as easy as acceptance","CNIL annual report 2022"],["29 Dec 2022","Apple Distribution International","€8m","Advertising identifiers set on iPhones (iOS 14.6) without consent","CNIL annual report 2022"],["29 Dec 2022","TikTok","€5m (two fines)","Refusal not as easy as acceptance; vague purposes","CNIL annual report 2022"],["29 Dec 2022","Voodoo","€3m","Mobile games: technical identifier used for ads without consent","CNIL annual report 2022"],["29 Dec 2023","Yahoo EMEA Limited","€10m","Cookies from about fifteen ad companies set without consent; the withdrawal path warned users they would lose access to Yahoo services such as Mail. Upheld 7 Oct 2025","CE n° 494300"],["14 Nov 2024","Orange","€50m","Ads shown as emails in the inbox (CPCE L. 34-5); cookies still read after withdrawal","CNIL, 10 Dec 2024"],["1 Sep 2025","Google LLC and Google Ireland","€200m + €125m","Gmail inbox ads without consent; ad cookies at account creation without valid consent. Injunction closed 23 Sep 2026","CNIL, 3 Sep 2025; CNIL, 14 Oct 2026"],["1 Sep 2025","Infinite Styles Services (Shein)","€150m","Cookies before any choice; incomplete banners; \"Tout refuser\" not respected","CNIL, 3 Sep 2025"],["20 Nov 2025","Les Publications Condé Nast","€750,000","vanityfair.fr: cookies before consent; ad cookies labelled \"strictly necessary\"; refusal failing","CNIL, 27 Nov 2025"],["27 Nov 2025","American Express Carte France","€1.5m","Trackers before consent, despite refusal and after withdrawal","CNIL, 3 Dec 2025"],["30 Dec 2025","Company not named by the CNIL","€3.5m","Loyalty data sent to a social network for ads without valid consent; 11 cookies set before any choice","CNIL, 22 Jan 2026"],["22 Oct 2026","Fnac Darty Participations et Services and Fnac Direct","€6m + €1m","App tracker sent user ID and viewed products to a third-party domain for recommendations, without consent","CNIL, 29 Oct 2026"]],"sourceUrls":[["https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-01-28/449209"],["https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423"],["https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840062"],["https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532","https://www.cnil.fr/fr/evolution-des-pratiques-du-web-en-matiere-de-cookies-la-cnil-evalue-limpact-de-son-plan-daction"],["https://www.cnil.fr/sites/default/files/2023-05/cnil_-_43e_rapport_annuel_-_2022.pdf"],["https://www.cnil.fr/sites/default/files/2023-05/cnil_-_43e_rapport_annuel_-_2022.pdf"],["https://www.cnil.fr/sites/default/files/2023-05/cnil_-_43e_rapport_annuel_-_2022.pdf"],["https://www.cnil.fr/sites/default/files/2023-05/cnil_-_43e_rapport_annuel_-_2022.pdf"],["https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2025-10-07/494300"],["https://www.cnil.fr/fr/publicites-inserees-entre-les-courriels-sanction-de-50-millions-deuros-orange"],["https://www.cnil.fr/fr/publicites-inserees-entre-les-courriels-et-cookies-la-cnil-sanctionne-google-dune-amende-de-325","https://www.cnil.fr/fr/cloture-injonction-google"],["https://www.cnil.fr/fr/cookies-deposes-sans-consentement-la-cnil-sanctionne-shein-dune-amende-de-150-millions-deuros"],["https://www.cnil.fr/fr/cookies-deposes-sans-consentement-la-cnil-sanctionne-la-societe-editrice-du-site-vanityfairfr"],["https://www.cnil.fr/fr/cookies-la-cnil-sanctionne-american-express-dune-amende-de-15-million-deuros"],["https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanction"],["https://www.cnil.fr/fr/sanction-cookies-app-fnac"]]}