CNIL re-issues guidance on cookies clarifying analytic cookies

By Gabriel Voisin


An updated version of the CNIL guidance on cookies has been published on the French Data Protection Authority's website. Highlights of the new guidance are as follows:

No consent needed for some categories of analytic cookies

Analytic cookies will be exempt from the new rules if the following conditions are met:

  • Publishers provide clear notice to visitors about their use of cookies. A link should be provided on the main page of the website and further information about analytic cookies should be displayed, for instance in the T&Cs;

  • User's right to access information is ensured;

  • Opt-out mechanisms are easy to install and accessible from each user device (including smartphones), operating system or browser application. Information shall not be shared with analytic providers if opt out mechanisms are on;

  • The analytic information is not linked to identifiable users. This means that that there will be no access to individual's information but rather access to aggregate information which includes all website users. In addition, publishers must not use the analytic information to track users across multiple websites (i.e. analytic information relating to a given website cannot be shared with others);

  • Geolocation based on IP addresses is permitted. However, the analytic information should not include any greater detail than city names. IP addresses must be deleted or anonymised once the geolocation has been completed  to prevent further use of the information which the CNIL considers ‘personal data’; and

  • Analytic cookie lifetime and storage of analytic information must not exceed 6 months.

As a result, the banner at the top of the CNIL webpage, similar to that used on the website of the UK data protection commissioner:, has been removed.

However, the CNIL mentions that its position might change in the coming months depending on the decision taken by the Article 29 Working Party.

Template consent wording provided

By way of illustration, the revised CNIL guidance envisages two practical situations where user consent might be needed.

Firstly, third party advertising providers. The CNIL recommends superimposing on the page visited by users the following consent wording: “Do you accept to receive a cookie from our partners PUBIX and ADVIX so as to analyze your interests and offer personalized ads? I AGREE / I REFUSE”.  The CNIL also suggests including a link to the T&Cs along with additional information about the use of cookies could be added to the above.

Secondly, social networking platforms. The CNIL recommends using the registration page to obtain user consent, specifically to add a tick box with the following consent wording: “By checking this box, I agree to receive cookies from while surfing on partner websites so as to identify myself when I want to share my favourite content with my friends.”

The CNIL’s revised guidance (in French) is made available at:

For more information, please contact:

          Ruth Boardman (Partner)

          Gabriel Voisin (Associate)