Cookie banners have become a fixture across much of the web. For a business launching its site in France, the question comes up quickly: do I need one, which one, and what should it look like? Some sites display one without needing it, and others show a banner that does not follow the rules.
The answer depends neither on the size of your business nor on the type of site, but on a single question: which trackers does your site use? This article relies on the texts of the CNIL, the French data protection authority: its 2020 guidelines and its recommendation on cookies, in the consolidated version published on 16 January 2026.
The rule: no tracker without consent, with a few exceptions
The reference text is article 82 of the French Data Protection Act, which transposes the EU “ePrivacy” directive into French law. It requires users to be informed clearly and fully, and then their consent to be obtained, before any operation that reads or writes information on their device. There are only two exceptions: operations whose sole purpose is to enable or facilitate electronic communication, and those strictly necessary for an online service the user has expressly requested.
Three points from the CNIL show that the rule goes further than people think:
- Not just cookies: it also covers browsers' local storage, device fingerprinting, identifiers generated by phone operating systems and hardware identifiers. Hence the word “trackers”.
- Not just personal data: the rule applies whether or not the information read or written is personal data.
- Every device: computers, smartphones and tablets, but also connected TVs, game consoles and vehicles.
Trackers that don't need consent
The CNIL gives a non-exhaustive list of trackers that can be considered exempt:
- trackers that store the user's choice about cookies;
- authentication trackers, including those that secure the login, for example against automated access attempts;
- trackers that remember an online store's shopping cart, or are used to bill purchases;
- interface personalisation trackers, such as the choice of language, where that personalisation is an expected part of the service;
- load balancing trackers across servers;
- trackers that allow paid sites to limit free access to a sample of content;
- some audience measurement trackers, under conditions (see below).
One condition applies to all of them: a tracker is only exempt if it is used solely for one of these purposes. The CNIL gives the example of a login cookie: it can be set without consent to authenticate the user, but if it is also used for advertising, consent is required again.
Exempt does not mean invisible: the CNIL recommends informing users that these trackers exist and what they are for, for example in the privacy policy. It mentions a cookie that only stores the user's preferred language: it can be covered by the exemption, and does not even count as processing of personal data.
The specific case of visitor statistics
Measuring your site's traffic is almost essential, and the CNIL takes this into account: audience measurement trackers can be exempt, but under strict conditions. They must:
- be used only to measure the site's audience, exclusively on behalf of its publisher;
- not allow the person to be tracked across other sites or apps;
- produce only anonymous statistics, without the data being combined with other processing or passed on to third parties.
The CNIL also recommends informing users about these trackers, limiting their lifetime to 13 months without extending it automatically on each new visit, and keeping the information collected for no more than 25 months.
In practice, it all depends on the tool and how it is configured. An analytics tool that reuses data for its own purposes, or passes it on to third parties, does not meet these conditions. The CNIL has a page on its website dedicated to audience measurement solutions: worth reading before you choose.
So, do you need a banner?
No, if your site only uses exempt trackers. A showcase website that remembers the chosen language and measures its audience with a tool configured to meet the conditions above does not need to ask for consent. The CNIL simply recommends explaining these trackers, in the privacy policy for example.
Yes, as soon as a tracker that requires consent comes into play. For example:
- an advertising pixel or retargeting tool, for your campaigns on social networks or search engines;
- audience measurement that does not meet the exemption conditions;
- share buttons or social media content that set trackers;
- embedded third-party content (video, map, booking, chat or anti-spam widget) that sets or reads its own trackers;
- any tracker used for personalised advertising or profiling.
For share buttons, the CNIL accepts a neat solution: only trigger the trackers when the user actually uses the sharing feature, and ask for consent at that moment rather than when they land on the site.
Watch out for other people's trackers. According to the CNIL, a site's publisher is responsible for the trackers it sets, even when it outsources their management to a provider, and an organisation that allows third parties to set trackers through its site must make sure a consent mechanism is actually in place. Not knowing what a widget installed on your site sets does not relieve you of responsibility.
The rules for a compliant banner
If your site needs a banner, here is what the CNIL expects.
Inform before asking
Before making a choice, users must at least know the identity of the controller(s) behind the trackers, their purposes, how to accept or refuse, the consequences of their choice and their right to withdraw consent. The CNIL recommends presenting each purpose under a short heading (“Personalised advertising”, “Sharing on social networks”…) with a brief description, and making the full, up-to-date list of companies using trackers on the site accessible.
A real “yes”, never a default yes
Consent must come from a clear positive action. The CNIL considers that continuing to browse a site, using an app or scrolling down a page does not amount to consent, and the Court of Justice of the European Union ruled in 2019 that pre-ticked boxes do not either. Notices such as “By continuing to browse, you accept cookies” are therefore not enough. Without a positive action, the user must be treated as having refused, and no tracker requiring consent may be read or set.
Refusing as easily as accepting
This is the key point. The CNIL strongly recommends that refusal be available on the same screen and with the same ease as acceptance. It considers that a banner requiring one click to accept but several to “configure” a refusal is, in most cases, likely to bias the choice. The solution it gives as an example: two buttons at the same level and in the same format, “Accept all” and “Refuse all”.
It also recommends buttons and fonts of the same size, equally readable and highlighted in the same way, with no misleading design suggesting that consent is mandatory. A “Continue without accepting” link can also express refusal, provided this option is clearly indicated to the user.
Allowing a choice per purpose
Global buttons are allowed, provided all purposes have been presented first. For a finer choice, the CNIL suggests a “Customise my choices” button at the same level as “Accept all” and “Refuse all”. Checkboxes must be unticked by default, and toggles switched off.
Remembering the choice, and letting users change it
The choice must be stored, otherwise the banner would reappear on every page. The CNIL considers that keeping both consent and refusal for 6 months is good practice. Users must also be able to withdraw consent at any time, as easily as they gave it: the CNIL suggests a “Manage my cookies” link, or an icon available on every page, for example at the bottom of the screen.
Being able to prove consent
The controller must be able to show at any time that consent was validly obtained. Among the methods the CNIL mentions: keeping time-stamped screenshots of the banner for each version of the site, or a time-stamped history of the consent management platform's settings (often called a “CMP”).
What about “cookie walls”?
Blocking access to the site until the user accepts, known as a “cookie wall”, may according to the CNIL undermine the freedom of consent in some cases. Whether it is lawful is assessed case by case, and users must then be clearly told the consequences of refusing. For a showcase website, it is a risk with no reason to take.
The classic mistakes
- No “Refuse all” button on the first layer, while “Accept all” is there.
- “By continuing to browse, you accept…”: browsing is not consent.
- Trackers set as soon as the visitor arrives, before any click: the banner is then pointless.
- Pre-ticked boxes in the customisation panel.
- No way to change your mind once the banner is closed.
- A banner shown when the site only uses exempt trackers: not forbidden, but a needless annoyance for your visitors.
How to find out which trackers your site uses
Before choosing a solution, take stock. A few practical steps:
- Open your site in a private window without clicking anything, then open the browser's developer tools (F12 on Windows): the “Application” tab in Chrome or the “Storage” tab in Firefox lists the site's cookies and local storage.
- Repeat after clicking “Refuse all”: no tracker requiring consent should appear.
- List the third-party services plugged into your site: analytics, advertising pixels, videos, maps, chat, booking, anti-spam. For each one, the provider's documentation usually states which trackers it uses.
- Ask your web provider for the list of trackers and their purposes: it is information they should be able to give you.
What are the risks?
The CNIL penalises breaches of these rules. A recent example: on 27 November 2025, it fined American Express €1.5 million for trackers set without consent, set despite the user's refusal, or read after consent had been withdrawn. The most publicised penalties involve large companies, but the rules apply to every site, whatever its size.
What could change
On 19 November 2025, the European Commission presented a package simplifying EU digital law, known as the “Digital Omnibus”. Among other things, it proposes moving the cookie rules into the GDPR, requiring a single-click option to refuse all cookies, obliging websites to respect the user's choice for at least six months, letting people set their preferences once and for all, for example in their browser, and exempting certain harmless uses, such as counting visits, from consent.
It is still only a proposal. According to the European Parliament's legislative tracker, updated on 20 September 2026, the text has not been adopted, and its cookie provisions are still under discussion: they may yet change. Until then, nothing changes, and the rules described in this article apply.
In short
- Take stock of your site's trackers, including those of third-party services.
- If they are all exempt (cookie choice, login, cart, language, compliant analytics): no consent banner, but an explanation in your privacy policy.
- Otherwise: a banner with “Accept all” and “Refuse all” at the same level, purposes explained, and no tracker before the choice.
- Store the choice (6 months is good practice) and offer a “Manage my cookies” link on every page.
- Keep a dated record of your configuration so you can prove consent.
- Check again every time a new tool is plugged into the site.
Cookies are only one part of a website's mandatory information: we cover the rest in our article on legal notices for a business website. And a site that needs no banner is something you decide at the design stage, by choosing the right tools. That is what we do for every showcase website: let's talk.
Sources
- Guidelines on cookies and other trackers, deliberation no. 2020-091 of 17 September 2020 (CNIL, in French)
- Recommendation on cookies and other trackers, consolidated version of 16 January 2026 (CNIL, in French)
- Cookies and other trackers: what does the law say? (CNIL, in French)
- Cookies: solutions for audience measurement tools (CNIL, in French)
- Cookies: American Express fined €1.5 million by the CNIL (CNIL)
- Digital Package, questions and answers (European Commission)
- The Digital Omnibus Regulation Proposal (European Parliament, legislative train)
