Multi-device consent: what the CNIL has recommended since January 2026
You accept cookies on your computer in the morning, then open the same service on your phone in the evening: should you have to answer a second time? For services with user accounts, the question comes up more and more, and the CNIL (the French data protection authority) has answered it. On January 16, 2026, it published its final recommendations on multi-device consent, following a public consultation opened in April 2025.
This article summarizes their content and who they are aimed at. The reference source remains the CNIL page (in French), which you should read before making any decision.
What are we talking about?
Multi-device consent is a choice expressed once and applied to all devices of the same user: phone, tablet, computer, connected TV, browsers and apps. The benefit is obvious for the user, who is no longer prompted on every device, and for the publisher, who gets a consistent choice from one device to the next.
This mechanism rests on one precise point: you must be able to recognize the person. That is why the recommendation only covers environments where the user is authenticated, which the CNIL calls "logged-in environments" (« univers logués »).
Who does the recommendation apply to?
It concerns organizations that choose to offer a single consent across all devices linked to an account. It regulates this practice; it does not make it mandatory.
In practice:
- A showcase site, a blog, a site with no logged-in area: you do not identify your visitors, so consent remains specific to each browser. The recommendation changes nothing for you.
- A platform with accounts (e-commerce, subscription media, an app, an online service): if you want a choice made on one device to apply on the others, you fall within the scope.
The conditions set by the CNIL
Clear information about the scope
The user must know that their choices will apply to all devices connected to their account. The CNIL indicates that this information can appear from the first level of the consent window. Without it, the user cannot gauge what they are consenting to, and the consent loses validity.
Refusal and withdrawal, with the same scope
This is the central point. If accepting once is enough for all devices, refusing or withdrawing consent must be just as simple and have the same scope. A journey where acceptance spreads everywhere but refusal has to be repeated device by device would contradict the long-standing principle that refusing must be as easy as accepting.
A reminder on a new device
When the user logs in from a new device, the CNIL recommends displaying a temporary message reminding them of the scope of their choices. The aim is to avoid surprise: the person must understand why no banner is displayed, and how to change their preferences.
When two choices contradict each other
A visitor may express a choice in the consent window before logging in, then discover that their account holds different preferences. The CNIL presents two acceptable methods:
- apply the last choice expressed in the consent window before login;
- give priority to the preferences saved in the account.
What matters is to pick one rule, document it and apply it consistently.
What this changes in practice
| Topic | What to plan for |
|---|---|
| First layer of the banner | State that choices apply to the devices linked to the account |
| Refusal and withdrawal | Propagate them to all devices, as simply as acceptance |
| Login from a new device | Temporary message reminding users of the scope of their choices |
| Conflict between two choices | Explicit, documented priority rule |
| Proof | Be able to trace who chose what, and when |
The last point is not specific to multi-device consent: whatever the scope, the publisher must be able to prove consent from its users. Consent that propagates from one device to another simply makes this record more valuable, since it must remain consistent from one device to the next.
What comes next: multi-site consent
The CNIL has announced that 2026 will see the start of its work on multi-property ("cross-domain") consent, that is, a single consent valid across several sites or media of the same group. This work will lead to recommendations submitted to public consultation. If you operate several sites, this is a topic to follow.
Key takeaways
- The January 16, 2026 recommendation regulates single consent for logged-in users; it imposes nothing on sites without accounts.
- Refusal and withdrawal must have the same simplicity and the same scope as acceptance.
- Information about the scope must appear from the first level, and a reminder is recommended on a new device.
- A clear priority rule must settle conflicts between choices made before and after login.
This article presents the recommendation factually and is not legal advice. To implement it on a service with accounts, rely on the CNIL's full text and, if needed, on your data protection officer. For the foundation common to every site, see our guide to the compliant cookie banner.
Consenteer collects and proves your visitors' consent, with an exportable log. Create a free account.