Key points
- A compliant cookie banner is governed by the GDPR and Article 82 of the French Data Protection Act (loi Informatique et Libertés), under the supervision of the CNIL (French data protection authority).
- Any storage or reading of cookies that are not strictly necessary for the service requested requires the user’s prior consent.
- Website publishers must provide clear information, obtain free and unambiguous consent, and allow users to refuse as easily as they accept.
- Proof of consent must be kept for each action, and users must be able to change their choice at any time.
- The design must not mislead users or amount to a “dark pattern” that steers them towards accepting.
- Fines can reach several million euros, which makes a regular audit of cookie management necessary.
A GDPR-compliant cookie banner remains essential for any business with a website in France. With the growth of European regulation and the increasingly demanding stance of the CNIL, managing user consent has become a central issue. Far from being a mere design feature, the banner involves precise technical choices and strict compliance with legal obligations. Here is a detailed guide written by lawyers to help you understand the requirements of the GDPR, improve your cookie management and achieve compliance from the design stage.
Legal framework for a cookie banner in France
The GDPR, supplemented by Article 82 of the French Data Protection Act, governs the use of trackers or cookies on the internet. The CNIL, the reference authority, set out its expectations on the wording and methods for obtaining user consent in its guidelines and its recommendation of 17 September 2020, thereby imposing rigorous practices in cookie management.
To ensure transparent information, the rules require that any storage or reading of cookies that are not strictly necessary to provide a service requested by the user be subject to the user’s prior consent. This rule covers in particular advertising cookies, analytics and social media cookies, and those used by third-party partners of the websites visited.
What are the main legal obligations?
To achieve genuine compliance, website publishers must follow several fundamental steps:
- Provide clear, legible and accessible information to all visitors
- Obtain freely given, specific, informed and unambiguous consent before any non-essential processing
- Allow users to refuse as easily as they can accept
- Record and keep proof of consent for each action
- Ensure users can change their choice at any time
In practice, CNIL inspections regularly lead to formal notices for a missing or defective GDPR-compliant cookie banner. Fines can reach several million euros, which makes the subject particularly sensitive for every business concerned.
The content of the banner must not mislead users, nor carry a message that plays up or plays down the importance of refusing. Any ambiguity in the design or user journey may result in a breach of the rules.
How do the rules keep pace with technological change?
With the rapid development of Consent Management Platform (CMP) solutions and the growing number of dedicated tools and plugins, the market offers many technical options. However, these tools never relieve the controller of the duty to check that they are compatible with its own legal obligations.
In addition, the website’s GDPR compliance must be checked regularly in the light of the latest available recommendations. To assess in practice whether your website meets the current requirements, see this guide on the criteria for a GDPR-compliant website: it covers key points such as the privacy policy, consent management through a cookie banner and other essential elements.
Regular testing of these platforms makes it possible to check that cookies are effectively blocked before consent: in the event of a CNIL inspection, an unsuitable tool offers no protection. Internal policies must therefore provide for a regular audit of cookie management, aimed at maintaining compliance despite changes in software architecture or service providers.
Design and features of a compliant cookie banner
Both the appearance and the functional mechanics of the banner play a decisive role under the rules. A good interface is not limited to a tick box: it helps visitors understand and supports their free choice.
The criteria of the CNIL and of the European bodies have evolved since 2020. Any design strategy must adopt the following good practices to avoid being classed as a “dark pattern”, which would consist in manipulating or nudging users towards accepting.
What must the first layer of the cookie banner show?
A GDPR-compliant cookie banner must include several items of information, in a brief but sufficiently explicit form:
- The exact purpose of the cookies placed
- The identity of the controller or controllers
- The list of the categories of trackers concerned
- A link to a detailed privacy policy covering the retention period, the nature of the data and the parties involved
- Clear indications of the consequences of refusing
The wording must not be misleading: the CNIL strongly recommends that refusal be available on the same screen and as easily as acceptance, for example through a “reject all” button, and that a “customise my choices” button appear at the same level of information. All of this immediately accessible, with no complex navigation and no compulsory scrolling.
A lack of symmetry in the display, for example a prominent “accept all” button and a discreet “reject all” link, fails to meet the requirement that refusing be as simple as accepting and exposes the publisher to a CNIL penalty. Particular care is needed when choosing the visual design and the wording of the banner.
What features are required for consent management?
The user consent obtained through the banner must trigger precise technical actions:
- No non-essential cookie may be placed before express acceptance
- The selected CMP must automatically block every script until the user has made an affirmative choice
- Granular settings must remain possible: grouping several purposes together without allowing a choice purpose by purpose may affect the validity of consent
On the technical side, you should make sure that no data leaks at all occur on the website’s back end while consent is pending. Secure storage of proof of consent, linked to a pseudonymised user identifier, makes it easier to demonstrate compliance in the event of an investigation.
It is often advisable to call on a professional who understands both the digital and the legal issues, particularly if your business involves processing sensitive or complex data. You can thus engage a law firm advising on the GDPR for tailored support in bringing your tools and cookie banners into compliance.
Users must be able to withdraw consent at any time, and withdrawing must be as simple as giving consent; the trackers concerned must then no longer be read or placed. Automated modules exist to manage this reversibility and to ensure cookie management that meets the CNIL’s expectations.
Technical implementation: installation, integration and monitoring
Installing a GDPR-compliant cookie banner requires coordination between lawyers, developers and marketing teams. The choice of a suitable tool or plugin depends on the CMS used, the volume of traffic and interactions with third-party services such as advertising platforms, analytics or social media services.
Preparation involves a full inventory of the cookies present on the domain, their categorisation, and then the customised configuration of the chosen CMP. Several essential steps help make your technical compliance legally sound.
What are the operational steps for installation and technical integration?
The typical deployment process includes:
- An audit of the existing set-up using dedicated scanners or manual inventories
- Drafting internal documentation on cookie management
- Advanced configuration of the CMP to ensure that nothing is triggered prematurely
- Cross-platform display testing (desktop, mobile, tablet, etc.)
- Validating that refusal and acceptance work effectively with a panel of users
Plugins or scripts that are incompatible with the new standards, often developed in-house or inherited from older interfaces, present major risks in the event of an actual inspection. Periodic renewal of these checks remains strongly recommended.
Integrating an “ongoing consent management” feature on every page ensures that users keep control of their choices on each new visit, in line with the CNIL’s expectations.
How should compliance monitoring and updates be managed?
A responsible approach relies on ongoing training of the teams concerned and regular updating of the notices displayed. Consent Management Platform (CMP) models evolve as regulatory interpretations change; continuous monitoring of case law and newly published guidelines is needed to prevent any gap.
By integrating tools that automatically monitor cookie placement, administrators can be alerted directly in the event of an anomaly. This set-up makes it possible to demonstrate a concrete commitment during a CNIL investigation or following a user complaint.
Frequently asked questions about cookie banner compliance
What is a consent management platform (CMP) and why choose one?
A Consent Management Platform (CMP) is software or a module built into a website that centralises the collection, storage and management of users’ cookie choices. It makes cookie management easier across several devices and automates blocking until user consent has been obtained.
- It streamlines compliance thanks to simplified configuration.
- It keeps proof of consent in case of an inspection.
- It offers a consistent user experience on desktop and mobile.
Using a reputable CMP limits human error and makes your compliance more robust in the eyes of the CNIL.
What are the risks of not having a GDPR-compliant cookie banner?
Failing to display a GDPR-compliant cookie banner, or collecting invalid consent, exposes the publisher to CNIL inspections, generally followed by a formal notice and sometimes by a significant fine.
| Risks | Consequences |
|---|---|
| CNIL inspection | Request for prompt changes / official order |
| Financial penalties | Fine of up to €10 million or 2% of annual worldwide turnover (Article 20 of the French Data Protection Act) |
| Loss of trust | Damaged reputation among internet users |
Keeping information transparent and up to date greatly reduces these risks.
What is the difference between strictly necessary cookies and other cookies?
Strictly necessary cookies enable the technical operation of the website or the service expressly requested by the user (for example, a shopping basket or authentication). They are exempt from the prior consent requirement.
- All cookies used for targeted advertising, social media sharing and behavioural analysis require prior consent.
- A complete map helps distinguish between these categories and adapt cookie management to the applicable rules.
Each time a new service or script is added to the website, a check is needed to determine which category it falls into.
Should user consent be collected again, and how often?
Yes, user consent must be renewed at appropriate intervals. The CNIL recommends recording the choice expressed, whether consent or refusal, so as not to ask the user again for a certain period; it considers six months to be good practice. Any new purpose also requires new consent, which means showing the cookie management banner again. Collecting consent is therefore not a one-off formality but an ongoing obligation whenever technologies, partners or uses change.
Official sources
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR) – CNIL (in French)
- Article 82 of French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés) – Légifrance (in French)
Texts consulted on 5 October 2026 on the official websites.
