France's Cookie Law: Article 82 of the Loi Informatique et Libertes
France does not have a standalone cookie law. Cookie consent obligations come from Article 82 of the Loi Informatique et Libertes (Law No. 78-17), which transposes Article 5(3) of the ePrivacy Directive into French national law. This provision has been in force since 2018 and was reinforced by updated CNIL guidelines published in October 2020.
Article 82 requires that any operation to store information or access information already stored on a user's terminal equipment may only occur after the user has been given clear, complete information about the purposes of these operations and has given consent.
The consent standard follows the GDPR definition under Articles 4(11) and 7 - it must be freely given, specific, informed, and unambiguous. Silence, pre-ticked boxes, or continued browsing do not qualify.
The CNIL's 2020 Updated Guidelines
In September 2020, the CNIL published revised guidelines on cookies and tracking technologies, replacing its earlier 2013 guidance. A six-month grace period followed, with full enforcement beginning on 1 April 2021.
The updated guidelines introduced several significant changes. Refusing cookies must be as straightforward as accepting them - a single-click "Accept All" button demands a matching "Refuse All" option at the same level of the interface. The CNIL explicitly rejected designs that required users to navigate through multiple screens to refuse tracking.
Cookie lifespan is capped at 13 months, and consent must be renewed at least every 13 months. Scrolling or continued browsing no longer counts as valid consent.
The guidelines also require that consent banners identify every data controller and clearly describe each purpose for which cookies are set. Generic statements such as "to improve your experience" are insufficient.
Which Cookies Are Exempt from Consent?
Not every cookie requires prior consent under French law. The CNIL exempts cookies that are strictly necessary for the service explicitly requested by the user. The exemption list is narrow.
| Cookie Type | Example | Consent Required? |
|---|---|---|
| Session / authentication | PHPSESSID | No |
| Load balancing | Server affinity cookies | No |
| User interface preference | pll_language | No |
| Shopping cart | E-commerce cart tokens | No |
| Audience measurement (limited) | CNIL-exempt analytics configs | No (if conditions met) |
| Advertising / retargeting | _fbp, IDE | Yes |
| Analytics (full feature) | _ga, _gid | Yes |
| Social media plugins | Like/share buttons | Yes |
The CNIL applies a specific exemption for audience measurement tools, but only if the analytics tool meets strict conditions: data must be limited to aggregate statistical purposes, personal data cannot be cross-referenced with other processing, and the tool must not enable individual user tracking across different sites. Standard Google Analytics 4 configurations do not qualify for this exemption.
Cookie Walls Under French Law
A cookie wall blocks access to a website unless the visitor accepts all cookies. The CNIL initially banned cookie walls outright in its 2020 guidelines, but the Conseil d'Etat (France's highest administrative court) struck down that blanket prohibition.
The CNIL then issued revised guidance: cookie walls are not automatically unlawful, but they must meet strict conditions. The publisher must offer a genuine, fair alternative for accessing the content without consenting to tracking. If no alternative exists on the publisher's own site, the CNIL expects evidence that comparable content is freely available elsewhere.
Where a cookie wall is used, only purposes directly tied to fair compensation for the service may be included. Bundling unrelated tracking purposes into a cookie wall undermines consent validity. Publishers relying on a "consent or pay" model must keep the subscription fee reasonable and proportionate.
CNIL Enforcement: A Track Record of Heavy Fines
The CNIL has been the most active data protection authority in Europe on cookie enforcement. Its sanctions send a clear signal to any organisation operating a website accessible from France.
In December 2020, the CNIL fined Google LLC EUR 60 million and Google Ireland Limited EUR 40 million for placing advertising cookies on users' devices via google.fr without prior consent. Amazon Europe Core received a EUR 35 million fine in the same round for similar violations.
Google was fined again in December 2021 - EUR 150 million - because refusing cookies on google.fr and youtube.com required multiple clicks, while accepting required only one. The CNIL held that this asymmetry made refusal more burdensome than acceptance, violating the requirement for equal ease.
Enforcement reached a new scale in September 2025 when the CNIL imposed a combined EUR 325 million fine on Google for placing cookies during account creation on Gmail without valid consent, and a EUR 150 million fine on Shein for depositing advertising cookies before users could interact with the consent banner. The CNIL's total sanctions in 2025 reached EUR 486.8 million across 83 decisions.
How CNIL Rules Relate to the GDPR
The relationship between France's cookie rules and the GDPR causes frequent confusion. Article 82 of the Loi Informatique et Libertes governs the act of storing or reading cookies on a device. The GDPR governs the subsequent processing of personal data collected through those cookies.
Both laws apply simultaneously. When a cookie collects personal data (which most analytics and advertising cookies do), the site must have a lawful basis under GDPR Article 6 in addition to meeting the consent requirement under Article 82. In practice, consent serves as the lawful basis for both obligations in most cases.
The CNIL enforces Article 82 directly. For cross-border GDPR complaints, the one-stop-shop mechanism may route enforcement to a lead supervisory authority in another EU member state. But cookie-specific violations under the ePrivacy transposition remain firmly within the CNIL's jurisdiction for sites targeting French users, regardless of where the data controller is established.
This dual framework applies across all EU member states, though each national authority takes its own enforcement approach. The German TTDSG, Italian Garante guidelines, Spanish AEPD guidance, and Belgian APD rules each reflect national transpositions of the same ePrivacy Directive.
Dark Patterns and CNIL Formal Notices
In December 2024, the CNIL issued formal notices to several website publishers over dark patterns in cookie banners. The targeted practices included burying the refuse option behind a secondary screen, using colour contrast to make the accept button visually dominant, and employing confusing toggle designs that left users uncertain whether tracking was on or off.
These formal notices are a preliminary enforcement step - the publisher receives a deadline to fix the banner. Failure to comply leads to a formal sanction with a public fine.
The CNIL's position is consistent: asymmetric banner design that nudges users towards acceptance is a violation of the freely given consent requirement. A compliant cookie banner must present accept and refuse options with equal visual weight.
Compliance Checklist for Websites Targeting France
Any website accessible to French visitors falls under the CNIL's jurisdiction. The following checklist covers the essential requirements.
Display a cookie banner before setting any non-essential cookies
Provide "Accept All" and "Refuse All" buttons at the same level - no hidden refuse option
List every purpose and every data controller in the banner or its first layer
Do not set advertising or analytics cookies until the user actively consents
Store proof of consent with a timestamp and the specific choices made
Limit cookie lifespan to 13 months maximum
Re-collect consent at least every 13 months
Allow withdrawal of consent at any time, with equal ease to giving it
Run a cookie audit to identify every tracker on your site
Ensure your cookie categories map accurately to the purposes described in your banner
If your site uses Google Consent Mode v2, verify that tags fire only after consent is granted and that your implementation passes the necessary consent signals to Google services.
Frequently Asked Questions
Does French cookie law apply to websites outside France?
Yes. If your website is accessible to users in France and sets non-essential cookies on their devices, the CNIL considers you subject to Article 82 of the Loi Informatique et Libertes, regardless of where your company is based.
Can I use a cookie wall on a French website?
Cookie walls are not automatically illegal in France, but the CNIL requires you to offer a genuine alternative for accessing content without consenting to tracking. A paywall alternative must be reasonably priced, and only purposes tied to fair compensation may be bundled into the wall.
How long can cookies last under CNIL rules?
The CNIL recommends a maximum cookie lifespan of 13 months from the moment consent is given. Consent itself must be renewed at least every 13 months.
Is Google Analytics exempt from consent in France?
Standard Google Analytics 4 configurations are not exempt. The CNIL's audience measurement exemption applies only to analytics tools that do not cross-reference data with other processing and do not enable individual tracking across sites.
What is the maximum fine the CNIL can impose for cookie violations?
The CNIL can impose fines of up to EUR 20 million or 4% of global annual turnover under the GDPR framework. For cookie-specific violations under Article 82, fines have reached EUR 325 million in a single case (Google, 2025).
Do I need separate consent for each cookie purpose?
Yes. The CNIL requires purpose-specific consent. Bundling all purposes into a single "Accept All" is permitted only if users can also granularly choose individual purposes. Pre-selecting purposes is not valid consent.
Take Control of Your Cookie Compliance
Meeting the CNIL's requirements starts with knowing exactly which cookies your site sets. Kukie.io scans your website, categorises every cookie it finds, and provides a consent banner with equal-weight accept and refuse buttons - built to meet French standards.
