Cookie consent in France: Article 82 and the CNIL rules

What is the French cookie law?

France transposed Article 5(3) of the ePrivacy Directive in Article 82 of the Data Protection Act of 6 January 1978, known as the loi Informatique et Libertés. Article 82 says that every user must be informed clearly and completely of the purpose of any action that reads or writes information on their device and of how to object, and that such access may only take place after the user has consented. Two exceptions apply: access whose sole purpose is to enable or facilitate an electronic communication, and access that is strictly necessary for an online service the user expressly requested.

The CNIL explains how it reads Article 82 in two texts adopted on 17 September 2020: guidelines (deliberation n° 2020-091) and a recommendation with practical examples (deliberation n° 2020-092). The guidelines say what the law requires; the recommendation shows ways to comply, and it is not binding as such. Sites had until the end of March 2021 to adapt, and the CNIL has run cookie inspections every year since.

What changed in 2025 and 2026?

On 18 December 2025 the CNIL adopted deliberation n° 2025-131, which adds a chapter on multi-device consent to the 2020 recommendation; a consolidated version was published on 16 January 2026. A site where visitors log in may apply one choice to every device connected to the account, but only on two conditions: a refusal or a withdrawal must travel across devices in the same way as a consent, and the visitor must be told before choosing that the choice will apply to all their logged-in devices. The mechanism is optional.

What must a cookie banner do in France?

The guidelines and the recommendation describe a banner that:

• sets no cookie subject to consent before the visitor acts; silence is never consent, and if closing the banner counts as refusal, the banner must say so;
• offers refusal with the same degree of simplicity as acceptance, which in practice means "Accept all" and "Reject all" buttons on the first screen, at the same level and in the same format;
• lists the purposes before the choice, with a way to accept or refuse purpose by purpose, and names the companies that use the trackers;
• lets the visitor withdraw consent at any time, as easily as it was given;
• stores the choice so the visitor is not asked again too soon. The recommendation considers keeping both a consent and a refusal for 6 months good practice, and recommends asking again at appropriate intervals.

The publisher must be able to prove that consent was obtained. Our article on the CNIL guidelines goes through the recommendation point by point.

Are cookie walls allowed in France?

Not as a rule, but not banned outright either. The CNIL's 2019 guidelines prohibited cookie walls in general terms, and the Conseil d'État annulled that general ban on 19 June 2020 because a soft-law text could not lay down an absolute prohibition. The 2020 guidelines therefore say that making access to a site conditional on accepting trackers may, in some cases, undermine the freedom of consent, and that the legality of a wall is assessed case by case. Where a wall is used, the visitor must be told clearly that refusing means no access to the content.

Do analytics cookies need consent in France?

Not always. France is one of the few countries with an analytics exemption. The CNIL considers that trackers used only to measure the audience of a site or app, for the publisher's sole benefit, are strictly necessary and exempt from consent if they:

• serve only audience measurement, not tracking a person across sites or apps;
• produce anonymous statistics only, with no cross-referencing with other processing and no transfer of the data to third parties;
• last no longer than needed to compare audiences over time, such as 13 months, without automatic extension on new visits;
• keep the collected information for 25 months at most;
• are mentioned to visitors, for example in the privacy policy.

A standard Google Analytics 4 setup does not meet these conditions, because the data does not stay with the publisher alone. A tool configured to meet all of them can run before the visitor chooses. See analytics without consent for the options.

How much are the fines in France?

Article 82 breaches are punished under Article 20, IV, 7° of the Act: up to 10 million euros or 2% of worldwide annual turnover, whichever is higher. The restricted committee applied this ceiling in its decision of 31 December 2021 against Google. Smaller cases go through the simplified procedure (Article 22-1), with fines up to 20,000 euros, raised to 100,000 euros for organizations with more than 50 million euros of turnover, and the organization's name is not published.

Because cookie fines are taken under French law and not the GDPR, the GDPR's one-stop shop does not apply, and the CNIL can fine companies headquartered in Ireland directly for cookies set on French users' devices. The main decisions of the restricted committee:

The pattern is consistent: cookies placed before any choice, refusal harder than acceptance, choices not respected, and cookies still read after the visitor withdrew consent.

How does Cookiequiet fit French rules?

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Accept all and Reject all sit on the first layer with the same weight by default, and the banner speaks French to visitors whose browser asks for it. Every choice goes into a consent log with its date and banner version, and geo-targeting is included on every plan, Free too. To see which of your cookies need consent, run the free cookie scanner.