The CNIL cookie guidelines explained: what France expects from your banner

The CNIL's cookie rules are two texts adopted on 17 September 2020: amended guidelines that state what article 82 of the French Data Protection Act (the French transposition of the ePrivacy Directive) requires, and a recommendation that describes how to comply in practice. Their core is short. Continuing to browse is not consent. Refusing trackers must be as easy as accepting them, which the CNIL translates into a "tout refuser" button next to "tout accepter". Visitors must be told the purposes and who sets the trackers. The site must be able to prove consent at any time. Websites had until the end of March 2021 to comply; since then the CNIL has issued around 90 formal notices and fines totalling several hundred million euros for breaking these rules.

Where the texts come from

The CNIL first adopted cookie guidelines on 4 July 2019. In a decision of 19 June 2020 the Conseil d'État upheld most of them but annulled the general ban on cookie walls, which is why the 2020 texts treat cookie walls case by case rather than prohibiting them outright. The amended guidelines (deliberation 2020-091) and the recommendation (deliberation 2020-092) followed on 17 September 2020 and were published at the end of that month. The guidelines restate the law; the recommendation is the CNIL's practical guidance, not binding as such, but the yardstick its investigators use.

What the rules say

Consent is a positive act. The guidelines say that merely continuing to browse a site can no longer be considered a valid expression of consent; a clear positive action, such as clicking "j'accepte", is needed. This aligns with the EDPB's guidelines on consent, which say scrolling or swiping never satisfies the requirement of a clear affirmative action.

Refusing must be as easy as accepting. The CNIL's sentence is "Refuser les traceurs doit être aussi aisé que de les accepter". The recommendation (paragraphs 27 and 32) describes two buttons on the first layer, presented at the same level and in the same format, such as "tout accepter" and "tout refuser", as a simple and clear way to let the user refuse as easily as consent. A "personnaliser" button on the same level can lead to purpose-by-purpose choices. The Reject all guide covers the design.

Information before consent. Users must be told, before consenting, the purposes of the trackers and the identity of all parties using trackers that require consent. The recommendation (paragraph 20) asks that an up-to-date list of those parties be permanently available at an easily accessible place on the site.

Withdrawal as simple as consent. Paragraphs 40 to 44 of the recommendation: users must be able to withdraw at any time, as simply as they consented, must be told before consenting how to do so, and the mechanism should be easy to find, for example a "gérer mes cookies" link accessible from every page or a cookie icon at the bottom left of the screen.

Proof of consent. Article 4 of the recommendation: controllers must be able to demonstrate at any time that users consented, with mechanisms in place to do so. Where a third party collects consent, a contractual clause alone is not enough; the collecting party should make the proof available to the others. How long to keep consent records turns this into a retention policy.

Remember the choice. Paragraph 39: keeping the user's choice, consent as well as refusal, for six months is good practice, so that the banner does not return on every visit.

Exempt audience measurement. The guidelines keep an exemption for audience measurement trackers that serve only the publisher, produce anonymous statistics and do no cross-site tracking, with a recommended tracker lifetime of thirteen months and data retention of twenty-five months. Analytics without consent explains the conditions.

How the CNIL enforced them

The CNIL announced an action plan with the texts and kept to it.

• 25 May 2021: formal notices sent on 18 May to about twenty organisations, mostly large digital companies and some public bodies, that did not let users refuse cookies as easily as accept them; one month to comply, with fines of up to 2% of turnover possible. All of them complied within the month.
• 23 July 2021: a second series of orders to comply on the same ground.
• 14 December 2021: about thirty new orders, bringing the total to nearly 90 organisations. The CNIL's investigations found cookies set before acceptance, banners that made refusal harder than acceptance, and refusal options that did not stop cookies.
• 31 December 2021: fines of €150 million for Google and €60 million for Facebook. On google.fr, youtube.com and facebook.com, accepting took one click; refusing required opening a settings screen and, in Google's case, at least five actions.
• December 2022: Microsoft (€60 million, bing.com) and TikTok (€5 million), again for refusal harder than acceptance, plus vague information in TikTok's case.
• 29 December 2023: Yahoo (€10 million) for advertising cookies placed without prior consent and a withdrawal that cost users their mail service.
• 12 December 2024: formal notices to publishers whose reject option was a discreet link, citing the EDPB taskforce report.
• 1 September 2025: Google (€325 million, in part for steering users toward advertising cookies at account creation) and Shein (€150 million, cookies placed on arrival and a refusal that did not work).
• November 2025 to July 2026: Condé Nast (€750,000), American Express (€1.5 million), and 23 simplified-procedure sanctions between January and July 2026, each capped at €20,000.

Our fines round-up has the complete table.

Did it change the web?

The CNIL measured. Its evaluation published on 21 June 2023 combined five IFOP surveys of French internet users with an observation of the 1,000 most visited sites in France between January 2021 and August 2022. The share of sites depositing more than six third-party cookies before any user action fell from 24% to 12%; the share depositing none rose from 20% to 29%. On the user side, 59% said they accept cookies and 39% refuse, and 49% configure their choices, up from 43%. The CNIL concluded that practices were improving but that tracking without consent remained potentially significant, and said it would keep its compliance effort on high-audience sites, which the 2025 fines confirm.

Does it apply outside France?

Directly, no: article 82 is French law and the CNIL's competence covers trackers set on devices in France, whoever operates the site. In substance, largely yes. The ePrivacy Directive is the same text everywhere, the EDPB's cookie banner taskforce reached positions in 2023 that match the CNIL's on reject buttons, pre-ticked boxes and discreet links, and the ICO's UK guidance asks for refusal as easy as acceptance in almost the same words. A banner built to the CNIL's recommendation is compliant in most of Europe; the reverse is not true.

The checklist

• Two buttons on the first layer, same level, same format: accept all, refuse all; a customise option beside them.
• No tracker before the choice; refusal and withdrawal that stop the trackers.
• Purposes and the list of parties, before consent, with the full list one click away.
• A way to withdraw on every page.
• The choice stored for six months.
• Consent records you can produce.
• Exempt analytics configured to the letter, or behind the banner.

Cookiequiet's defaults were designed from this list: equal Accept all and Reject all buttons, a Customize button, no pre-ticked category, blocking before consent, a withdrawal link, a 182-day stored choice and a consent log; the wording is editable in French and 23 other languages.