A banner that offers “Accept all” in one click and hides refusal in a submenu does not meet what the CNIL expects. Its rule fits in one sentence: refusing trackers must be as easy as accepting them. It dates from September 2020, yet it is still one of the most common mistakes found on websites.
What the law says
Article 82 of the loi Informatique et Libertés (the French Data Protection Act, law No. 78-17 of 6 January 1978) transposes Article 5(3) of the ePrivacy Directive. It requires users to be informed clearly and completely of the purpose of any access to, or storage of, information on their device, and of the means to object. Such access or storage may only take place after the user has consented.
What the CNIL adds
In its amending guidelines and its September 2020 recommendation, the CNIL specifies that simply continuing to browse can no longer be regarded as a valid expression of consent: a clear positive action is required. It also recommends that the consent interface offer a “Reject all” button next to the “Accept all” button, and that users can withdraw their consent easily at any time.
What does not require consent
Article 82 provides two exceptions: access or storage whose sole purpose is to enable or facilitate communication by electronic means, and access or storage that is strictly necessary to provide an online communication service expressly requested by the user. In practice, the CNIL cites authentication, keeping a shopping cart and certain audience measurement. These trackers do not go through the banner.
What a non-compliant site risks
The CNIL can issue a formal notice to the organization, then impose an administrative fine. The ceiling is €10,000,000 or 2% of worldwide annual turnover, whichever is higher, rising to €20,000,000 or 4% in the cases covered by Article 83 of the GDPR. These are ceilings, not price lists: a small business is not exposed in the same way as a large group.
Four checks to run on your own site
Is refusal visible on the first level of the banner? Open your site in private browsing and count the clicks needed to accept, then to refuse.
Is any tracker set before the user chooses? The “Application” tab in your browser's developer tools shows what is written as soon as the page loads.
Can visitors withdraw their choice? A permanent link in the footer is the simplest solution.
Does your cookie policy match the tools actually installed? An advertising pixel added by a provider makes the page inaccurate without anyone noticing.
Compliance remains the responsibility of the business owner: this article is for information only and does not replace the advice of a lawyer or a DPO on a specific situation.
Source: article 82 and article 20 (IV, 7°) of law No. 78-17 of 6 January 1978, pages “La loi Informatique et Libertés” on cnil.fr; “Cookies et autres traceurs : la CNIL publie des lignes directrices modificatives et sa recommandation”, cnil.fr, pages accessed on 3 November 2026.
