Blog · Understanding the regulations · · 5 min read

Cookie banners: what GDPR and the CNIL actually require

Article illustration: Cookie banners: what GDPR and the CNIL actually require

The cookie banner is often treated as a formality to be dispatched at the end of a project. Yet it is one of the points most checked by the CNIL (the French data protection authority), and one of the most visible to your visitors. Here is what the law actually requires of a consent banner in France, no more and no less.

Where the rules come from

Two texts combine. The European ePrivacy directive, transposed in France by article 82 of the Informatique et Libertés law (the French Data Protection Act), sets the principle: no access to or storage of information on the user's device (cookie or other tracker) without their prior consent, except for strictly defined exceptions. The GDPR defines what valid consent is (article 4.11: freely given, specific, informed and unambiguous) and requires that it can be proven (article 7).

The CNIL has clarified how these texts apply in its guidelines and in its "cookies and other trackers" recommendation of September 17, 2020, which remain the operational reference for any site aimed at a French audience.

The six concrete requirements

1. No tracker before consent

As long as the visitor has not made a choice, no cookie subject to consent may be set and no measurement or advertising script may run. This is the most frequent failure: the banner is displayed, but the analytics tags have already fired. Automatic blocking of third-party scripts, upstream of the choice, is the most reliable way to meet this requirement.

2. Active consent

Continuing to browse, scrolling the page or ignoring the banner does not amount to consent. Only a clear positive action, such as a click on "Accept", is valid. Conversely, the absence of a choice must be treated as a refusal.

3. Refusing must be as easy as accepting

If accepting takes one click, refusing must take one click at the same level. On this basis, at the end of 2021 the CNIL fined Google 150 million euros and Facebook 60 million euros: their banners allowed users to accept in one click but required several actions to refuse. The order and presentation of the buttons matter: a visible, non-greyed-out "Refuse" button, presented before or at the same level as "Accept all".

4. Clear and complete information

Before choosing, the visitor must know what they are consenting to: the purposes of the trackers (audience measurement, personalized advertising, social networks, etc.), written in plain language, and the identity of the controllers operating those trackers. A customization screen must make it possible to accept or refuse purpose by purpose.

5. A choice that can be withdrawn at any time

Withdrawing consent must be as easy as giving it (GDPR article 7.3). In practice: a link or badge permanently accessible on the site, which reopens the preferences panel. The CNIL also recommends not asking the visitor again too often and keeping their choice, refusal included, for a period of about six months.

6. Proof that is kept

In the event of an inspection, it is up to the site publisher to demonstrate that consent was validly collected. Each consent must therefore be logged: when, for which purposes, with which version of the banner. We cover this point in a dedicated article on proof of consent.

Not every cookie triggers the obligation. Trackers strictly necessary for the service requested by the user are exempt: session cookies, shopping cart, language choice, authentication, load balancing, and the cookie that remembers the refusal of the other cookies.

Audience measurement can also be exempt, but under strict conditions defined by the CNIL: the purpose is limited to producing anonymous statistics for the publisher's sole account, no cross-referencing with other processing, and no tracking of the person across multiple sites. Mainstream analytics tools in their standard configuration generally do not meet these conditions.

The checklist

  • No cookie subject to consent set before the visitor's choice.
  • "Refuse" and "Accept" buttons at the same level, one click each.
  • Purposes and controllers listed, with customization possible purpose by purpose.
  • Choice kept (refusal included) and changeable at any time through permanent access.
  • Exportable consent log, with timestamp and banner version.
  • Cookie inventory kept up to date: an automatic scanner avoids omissions as the site evolves.

Consenteer applies these requirements by design: automatic blocking of scripts before consent, button order in line with the CNIL's recommendations, an exportable log and a cookie scanner. See the features or create a free account.