CNIL cookie fines: what they say about banners and audience measurement
Updated November 3, 2026
Since 2020 the CNIL's largest fines have been about cookies. They target large companies, but the rules they apply are the same for every site. These are the main ones, from the decisions the CNIL published and their press coverage, and what they say about your banner. It is general information, not legal advice.
The main decisions
| Decision | Company | Amount | What was wrong |
|---|---|---|---|
| December 2020 | Google (LLC and Ireland) | 100 million euros | Advertising cookies set on arrival on google.fr without consent, and incomplete information |
| December 2020 | Amazon Europe Core | 35 million euros | Cookies set on arrival on amazon.fr without consent; fine upheld by the Conseil d'État |
| 31 December 2021, announced January 2022 | Google (LLC and Ireland) | 150 million euros | Refusing cookies took several clicks, accepting took one (google.fr, youtube.com) |
| 31 December 2021, announced January 2022 | Facebook (Facebook Ireland) | 60 million euros | The same issue on facebook.com |
| 19 December 2022 | Microsoft Ireland | 60 million euros | No button to refuse cookies as easily as to accept them on bing.com |
| 1 September 2025 | Google (LLC and Ireland) | 325 million euros | Ads placed between Gmail emails without consent, and cookies set when creating an account |
| 1 September 2025 | Shein (Infinite Styles Services) | 150 million euros | Cookies set on shein.com without valid consent |
Most of these decisions came with an order to comply within three months, with a penalty for each day of delay.
Lessons for a banner
- Nothing before the choice. A tracker that needs consent is not set when the page loads. It waits for the click on "Accept".
- Refusing as easy as accepting. A "Reject all" button at the same level as "Accept all", in the first window. That was the issue in the 2021 and 2022 decisions.
- A refusal has to stop the trackers. A banner that records the refusal but leaves the tools running protects nothing.
- Complete information. The visitor has to know what the cookies are for before choosing.
- Small sites too. The fines hit large groups, but the CNIL also sends formal notices to ordinary site owners, often after a complaint. The 2022 procedure about Google Analytics concerned a French site whose name was not published.
And audience measurement?
None of these decisions is about an exempt audience measurement tool. They are a reminder that anything outside the exemption goes through consent, and that the CNIL checks how that consent is collected.
Audience measurement set up for the CNIL criteria needs no banner; it needs information and an opt-out button. What stays behind the banner, such as advertising, videos or retargeting, has to follow the rules above. The criteria are explained in The CNIL consent exemption: the July 2025 criteria explained, and Google Analytics in Is Google Analytics illegal in France?.
To see which trackers your home page sets before any choice, run it through our free site check.