The CNIL consent exemption for audience measurement: the July 2025 criteria

In France, an audience measurement tool can run without a consent banner if it meets the conditions of the CNIL. On 4 July 2025 the CNIL updated its page "Cookies : solutions pour les outils de mesure d'audience" and published a self-assessment tool that spells those conditions out for providers. The CNIL kept a list of evaluated solutions for a long time; its current page no longer publishes one and points to the self-assessment instead. This article explains what it asks for and what a site owner should check. It is general information, not legal advice.

The rule and its exception

Article 82 of the French data protection act requires consent before storing or reading information on a visitor's device. It covers cookies, but also any other technique: pixels, local storage, fingerprinting. Cookieless measurement does not escape the rule by default.

The exception covers trackers that are strictly necessary for the service. The CNIL counts audience measurement among them when four conditions are met:

1. it only measures the site's audience, for the site owner alone;
2. it only produces anonymous statistics;
3. the data is not combined with other processing or passed to third parties in a non-anonymous form;
4. it cannot follow a person from one site or app to another.

The CNIL also recommends informing visitors (in the privacy policy), limiting the lifetime of trackers to 13 months without extending it on each visit, and keeping the data for 25 months at most.

What the self-assessment adds

The July 2025 tool is for providers. It tells whether a solution can be configured to fall under the exemption, and asks the provider to give its customers a document on the CNIL's template, with the settings to apply. It does not judge whether the tool complies with the GDPR as a whole.

Allowed features

Measurement must be limited to five uses: measuring performance, detecting navigation problems, optimising technical performance or usability, estimating the server capacity needed, and analysing the content viewed.

Excluded features

Anything that serves marketing must be off by default. The grid names the performance of conversion channels and advertising campaigns, the measurement of acquisition channels, ad fraud detection, and any creation of user cohorts to show them different content. A/B tests fall under the last one.

For a doubtful feature the CNIL suggests a simple question: without this measurement, can the site still do what the visitor asked for? Economic interest is not enough to make it "strictly necessary".

Technical criteria, by objective

Objective	What the grid asks for
A single purpose, audience measurement	Instructions to turn off features outside the scope; minimised HTTP headers (the major browser version, for example); at most three event types: presence on a page, use of a feature (a button or link click, with its label), load time, scrolling or time spent
The provider is a processor	A processing agreement (article 28 of the GDPR); no pooling of raw data from several customers; no reuse for its own purposes; a contact point
No tracking outside the site	No customer (CRM) id, UTM tag or campaign id collected from URLs; referrer limited to the host; no integration with third-party tools; a first-party cookie if there is one; the IP address used at most for the city, then truncated by at least one byte; a fingerprint computed with a site-specific and a time component; no form that collects personal data; no unified reach measurement
Anonymous statistics only	Reports and exports rounded to the nearest ten, or an analysis that proves they are anonymous; no combination of filters that isolates a user; no session replay
The right to object	An opt-out button or link in the privacy policy; a refusal kept over time (opt-out cookie, or the fingerprint put on an exclusion list)

Where the grid names a specific technical measure, it is a recommendation: the provider may use another one if it shows that it meets the same goal and says so in its documentation.

The most common traps

• UTM tags. A report per campaign or newsletter is marketing. The parameters have to be discarded, not just hidden on screen.
• Small numbers. A report filtered on one city and one browser can describe a single person. Hence rounding to the nearest ten and hidden rows.
• The visits log. Seeing the path of one specific visitor, even without a name, is tracking a single user.
• Integrations. Connecting the tool to an ad network, a CRM or another service takes it out of scope.
• The default setup. Most tools are not exempt as installed. Google Analytics has never been among the tools the CNIL considered able to be.

What the site owner checks

1. Ask the provider for its self-assessment document and apply the settings it lists.
2. Add the opt-out button to your privacy policy and describe the measurement there.
3. Check that retention does not exceed 25 months.
4. List the other trackers on the site: advertising, embedded videos, widgets. They still need consent, and so a banner.
5. Remember that the self-assessment does not bind the CNIL, which can inspect a site. A provider may not call itself "certified" or "validated by the CNIL" or use its logo; it may say that its solution "can fall under the exemption".

For Statsdot, the document is our CNIL self-assessment, and the settings fit in one checkbox, the CNIL exemption mode. For other tools, see Matomo and the CNIL exemption and Is Google Analytics illegal in France?.