{"page":"/blog/cnil-cookie-rules","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Ad tech practice","What the CNIL texts or decisions say","Decision to read"],"rows":[["SSP, DSP or exchange pixels and cookie sync on page load","Consent first; the publisher must police partners' trackers","Yahoo (CE, 2025)"],["Reading cookies after a refusal or withdrawal","Breach, even if no new cookie is set","Orange, Amex, Shein, Condé Nast"],["Ad cookies labelled \"strictly necessary\" in the CMP","Breach of information and consent","Condé Nast"],["Server-side or API calls carrying a user ID from an app","Treated as a tracker; consent needed for recommendations and targeting","Fnac (2026)"],["Mobile advertising identifiers","Consent needed before use for ads","Apple, Voodoo (2022)"],["Audience measurement sold to many publishers","Exempt only with per-publisher separation and no reuse","CNIL page, 4 July 2025"],["Ads styled as emails in a webmail inbox","Needs consent under CPCE L. 34-5 unless clearly distinct from email","Orange; Google injunction closure"]],"sourceUrls":[[],[],[],[],[],[],[]]}