← ALL REGULATIONS
Cookie consent in France, by the CNIL’s rules.
France requires consent before non-essential cookies are set, and the CNIL expects refusing to be as easy as accepting. It has enforced both with some of Europe’s largest cookie fines, against Google, Amazon, Facebook and others.
CNIL at a glanceOpt-in before tracking
- Applies to
- Sites that set cookies on the devices of people in France
- Cookie rule
- Article 82 of the French Data Protection Act
- Guidance
- CNIL guidelines and recommendation on cookies, 2020
- Enforced by
- CNIL
- Largest cookie fine
- €325 million, Google, 2025
WHAT CNIL REQUIRES
The rules the CNIL has fined companies for breaking.
THE RULERefusing must be as easy as acceptingThe CNIL fined Google €150 million and Facebook €60 million in 2021 because declining cookies took more clicks than accepting them.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULENo cookies before consentAdvertising cookies set as soon as the page loaded, before any choice, were behind the €100 million and €35 million fines against Google and Amazon in 2020.
WITH KATLAIn GDPR mode, the cookie guard refuses every cookie outside the functional category until the visitor chooses, and deletes any that were set before it ran.
THE RULESome audience measurement is exemptThe CNIL exempts analytics strictly limited to measuring the site’s own audience, under conditions it publishes. Anything beyond that, including most standard analytics setups, needs consent.
WITH KATLAKatla treats analytics as a consent category. If your measurement meets the CNIL’s exemption, you can reclassify that cookie as functional in Katla.
THE RULEAsk again after a reasonable timeThe CNIL recommends keeping a visitor’s choice for about six months before asking again, and a cookie lifetime of no more than 13 months.
WITH KATLAKatla stores a choice for 12 months: inside the 13-month limit, but longer than the six months the CNIL recommends. There is no setting to shorten it yet.
CNIL questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Is a "Continue without accepting" link enough?
- The CNIL has accepted a clearly visible link to continue without accepting on the first layer, as long as refusing takes no more effort than accepting and the link is not hidden or disguised.
- Which cookie fines has the CNIL issued?
- Among them: Google €100 million and Amazon €35 million in 2020 for cookies set before consent, Google €150 million and Facebook €60 million in 2021 for making refusal harder than acceptance, and Google €325 million in 2025.
- Do I need consent for analytics in France?
- Usually. Only audience measurement that meets the CNIL’s exemption conditions can run without it; a standard analytics setup that uses the data for other purposes cannot.
- Does the banner need to be in French?
- Consent has to be informed, which in practice means in the visitor’s language. Katla’s banner and generated policies are available in French.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.