Why the CNIL Matters Beyond France

France's data protection authority, the CNIL, is one of the most active enforcers of cookie rules in Europe. Its guidance has shaped how many publishers across the EU design their banners, and its decisions are closely watched by ad-ops and legal teams. If you serve visitors in France, or simply want a practical reference for a strict regulator's expectations, the CNIL's approach is worth understanding in detail.

The Legal Basis

French cookie rules combine two layers. The ePrivacy rules, transposed into French law, require consent before information is stored on or read from a visitor's device, unless an exemption applies. The GDPR then defines what valid consent means: freely given, specific, informed and unambiguous. The CNIL published updated guidelines and a recommendation in September 2020 and gave organisations a transition period before enforcement began in spring 2021.

Core Expectations

• Refusing must be as easy as accepting. If the first layer offers an accept button, it should offer a comparably easy way to refuse, such as a clearly visible reject button at the same level.
• No consent through continued browsing. Scrolling, clicking elsewhere on the page or simply continuing to use the site is not a valid choice.
• No pre-ticked boxes. Purposes must be off until the visitor turns them on.
• Specific, granular choices. Visitors should be able to choose by purpose, with plain-language descriptions.
• Named third parties. The people whose cookies will be set should be identifiable from the banner or its second layer.
• Withdrawal as easy as giving consent. A persistent link or icon that reopens the choices is the usual approach.

Consent Lifetime and Cookie Duration

The CNIL recommends that a recorded choice, whether acceptance or refusal, is kept for a limited period and that visitors are asked again after about six months. Separately, it has recommended limits on how long certain tracking identifiers should live. Treat these as the regulator's stated expectations, and check the current text of the recommendation when you set your own durations, since guidance can be revised.

The Audience-Measurement Exemption

The CNIL has set out conditions under which some analytics tools can run without consent. The tool must be used for strictly limited purposes, such as measuring audience and performance of your own site, and must not combine data with other processing or track users across sites. Many popular analytics configurations do not meet those conditions by default. Do not assume your analytics vendor qualifies; verify its configuration against the CNIL's published criteria.

What the CNIL Looks For in Practice

1. Does the banner show a refuse option at the same level as accept?
2. Are non-essential cookies and scripts actually held back until consent exists?
3. After a refusal, do tracking cookies still appear? The CNIL can check this technically.
4. Can a visitor change their mind at any time?
5. Are the wording and design neutral, without visual tricks that push toward acceptance?

A Practical Review Routine

Open your site in a clean browser profile with a French IP or region setting, refuse everything and inspect storage and network requests. Then accept only one purpose and repeat. If trackers load after a refusal, the problem is almost always a hard-coded tag outside your consent tooling. Fix that first, because it is the kind of issue a regulator can reproduce in minutes.

How FlexyConsent Helps

FlexyConsent is certified by IAB Europe and IAB Canada, is a Google-certified CMP (ID 317), supports IAB TCF 2.4 and Google Consent Mode v2, and shows the banner in 57 languages, including French. It covers the EU/EEA and UK, so a single setup can serve French visitors alongside the rest of your audience.

Key Takeaways

• The CNIL expects refusing to be as easy as accepting, with no consent by scrolling or continued browsing.
• Choices should be granular, with named third parties and an easy way to withdraw.
• Ask again after a limited period; the CNIL points to roughly six months.
• The audience-measurement exemption is narrow, so verify your analytics setup instead of assuming.
• Test by refusing everything and checking that trackers really stay off.