Skip to content

CNIL exemption mode

Updated November 3, 2026

In France, audience measurement can run without consent when it meets the conditions of the CNIL. In July 2025 the CNIL published a self-assessment for providers that spells them out: measurement only, anonymous statistics, no tracking across sites, no reuse by the provider, and a way for visitors to refuse. Some Statsdot features go further than that list, such as campaign tags and revenue, so a site that wants the exemption turns them off with the CNIL exemption mode.

What the mode changes

For that site, while the mode is on:

  • Not stored: UTM campaign tags, revenue, order numbers sent as conversion ids and custom properties. You can keep the same snippet: the server drops them.
  • Not shown: the Channels and UTM tabs, revenue and properties. Sources show referring sites only.
  • Rounded: every count in the dashboard, shared links, email reports, CSV exports, the API, the MCP server and the live widget is rounded to the nearest ten, the measure the CNIL recommends. Rows that round to zero (fewer than 5 visitors) are not shown, and a filter or combination of filters that leaves fewer than 5 visitors shows nothing. So no row or filter can single out one visitor.
  • Off: imports from other tools and Search Console. Days imported before stay. Disconnect Search Console before turning the mode on.
  • Unchanged: pages, entry and exit pages, referring sites, countries, regions and cities, devices, browsers and systems, events with their labels, goals, funnels, journeys, scroll depth, notes, alerts and AI crawler tracking.

Small sites notice the rounding most: with 3 visitors a day the daily chart shows 0, while the totals of a week or a month stay useful.

Turning the mode off brings the features back for new visits. Visits recorded while it was on have no campaign tags or revenue.

Turn it on

  1. Open the site settings (the cog next to the period buttons), section General, and tick Turn on the CNIL exemption mode.
  2. Add the opt-out to your privacy policy page (below).
  3. Describe the measurement in your privacy policy (below).
  4. Check what else your site loads: the mode covers Statsdot only.

The visitor opt-out

The CNIL asks that visitors can refuse the measurement, for example with a button in the privacy policy. Paste this where the button should appear:

<div data-statsdot-opt-out></div>
<script defer src="https://statsdot.com/js/opt-out.js"></script>

It shows one sentence and a button in the language of the page (data-lang="fr" on the div chooses another: en, es, de, fr, it or pt). The choice is saved in the browser's local storage for your site, and the Statsdot script reads it before sending anything, so nothing is sent while it is set. It sets no cookie and sends nothing to Statsdot. The choice applies per browser and per address: www.example.com and example.com keep separate choices, so use the address your site redirects to.

What to write in your privacy policy

Adapt this text to your site and your retention period:

Audience measurement. We measure visits to this site with Statsdot to produce anonymous statistics on how it is used: pages viewed, referring sites, country, type of device and browser. Statsdot sets no cookies and does not store your IP address. Each visit gets a code that changes every day, so it cannot recognise you on another day or on another site. Only we use these statistics; Statsdot, our processor, does not reuse them. They are kept for at most 24 months on servers in Germany; requests pass through Cloudflare. You can refuse this measurement with the button below.

Then the opt-out snippet. The French version of this text is on the French page.

Limits

  • The mode covers Statsdot. Advertising pixels, embedded videos, maps or chat widgets that set cookies or follow visitors still need consent.
  • The CNIL does not certify or approve tools. Our self-assessment explains how Statsdot meets each criterion and what you have to do; the CNIL can still check a site during an inspection. Whether your site needs a banner is your decision, with your adviser if you have one.
  • The mode follows the CNIL criteria. Other authorities have their own, and German authorities judge each setup case by case.
  • The data processing agreement applies with the terms of service.