FRANCE

Moderate Guidance Published France · Oct 9, 2026

CNIL hosts 2nd Rencontres Informatique & Libertés on connected glasses and data‑sanctions

The French data‑protection authority CNIL held its second Rencontres Informatique & Libertés on 29 September 2026, featuring panels on the privacy impact of connected glasses and the role of sanctions under the GDPR. The event gathered…

CNIL · RGPD

Moderate Enforcement Decided France · Oct 8, 2026

CNIL closes injunction against FRANCE TRAVAIL after compliance with data security measures

The French data protection authority (CNIL) closed the injunction issued on 22 January 2026 against FRANCE TRAVAIL, after the organization demonstrated compliance with the security measures required by Article 32 of the GDPR. The original…

CNIL · RGPD

Moderate Proposed regulation Proposed France · Oct 8, 2026

CNIL examines draft deliberation authorizing BIG DATA SANTE to process personal data for anonymized medical research (ONCOVAL)

During its plenary session on 8 October 2026, the CNIL will consider a draft deliberation that would permit BIG DATA SANTE (Octopize Mimethik Data) to carry out automated processing of personal data to create anonymised datasets for…

Commission nationale de l'informatique et des libertés (CNIL) · Law of 6 January 1978

Moderate Guidance Published France · Oct 2, 2026

CNIL explains when data‑breach victims can claim compensation under the GDPR

The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…

CNIL · RGPD

High Guidance Published France · Oct 1, 2026 · effective Oct 1, 2026

CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response

The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for…

CNIL

Moderate Proposed regulation Announced France · Oct 1, 2026

CNIL to examine draft decree on student violence questionnaire and automated vehicle sound monitoring

The CNIL plenary session on 1 October 2026 will examine a draft decree authorising personal data processing for a "Questionnaire violences sexistes et sexuelles" in schools. It will also review draft orders on sound radars and an automated…

Commission nationale de l'informatique et des libertés (CNIL) · règlement intérieur de la CNIL

Moderate Guidance Announced France · Sep 28, 2026

CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026

The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…

CNIL · RGPD

Moderate Proposed regulation Proposed France · Sep 24, 2026

CNIL examines draft decree creating SI-Mandoline personal data system for protection of adults

The CNIL plenary session on 24 September 2026 will examine a draft decree establishing the personal data processing system "Système d’information de la protection juridique des majeurs" (SI-Mandoline). It will also consider a draft decree…

Commission nationale de l'informatique et des libertés (CNIL) · code de commerce

Low Enforcement Decided France · Sep 24, 2026 · effective Sep 17, 2026

CNIL closes injunction against SOLOCAL MARKETING SERVICES

The French data protection authority CNIL closed the injunction it issued on 15 May 2025 after the company demonstrated measures to verify the validity of consent obtained by its data‑broker partners. The original sanction included a…

CNIL · code des postes et des communications électroniques (CPCE)

Moderate Guidance Published France · Sep 17, 2026

CNIL outlines its status, organization and sanction powers

The CNIL, created by the 1978 Loi Informatique et Libertés, is an independent administrative authority composed of a college of 18 members. Its restricted board can impose fines up to €20 million or 4 % of global annual turnover under the…

CNIL · loi Informatique et Libertés

Moderate Proposed regulation Announced France · Sep 17, 2026

CNIL plenary agenda includes draft decrees on prison camera use, Apple ATT, and data collection in real‑estate rentals

The CNIL plenary session of 17 September 2026 will discuss a draft decree on the use of on‑board cameras by prison surveillance staff, a draft decree amending the 2019 decree that implements the French data protection law, and a…

Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2019-536 du 29 mai 2019

High Fine Decided France · Sep 11, 2026 · effective Jul 21, 2026

CNIL fines French IT firm EXTIA €300,000 for failing to honor data erasure requests

In 2024 EXTIA received 265 requests for erasure, many of which were not processed or not communicated to the requesters. The CNIL audit found breaches of Articles 12 and 17 GDPR regarding transparency and the right to erasure. The CNIL…

CNIL · General Data Protection Regulation

Moderate Guidance In effect France · Sep 10, 2026 · effective Sep 1, 2026

CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026

The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…

CNIL · réforme relative à la facturation électronique

Moderate Proposed regulation Proposed France · Sep 10, 2026

CNIL to examine draft deliberation on finance bill 2027 provisions for online platform content collection for tax purposes

The CNIL plenary session on 10 September 2026 will examine a draft deliberation giving an opinion on provisions of the 2027 finance bill that would perpetuate the collection and exploitation of content from online platforms for tax…

Commission nationale de l'informatique et des libertés (CNIL) · projet de loi de finances pour 2027

Moderate Guidance Published France · Sep 10, 2026

CNIL releases Volume 2 of “L’Agence Privacy” to educate adolescents on cybercrime and data privacy

On 10 September 2026 the French data‑protection authority CNIL published the second volume of its educational comic series “L’Agence Privacy”. The free online and paper resource targets teenagers and parents, covering risks such as…

CNIL

Moderate Proposed regulation Announced France · Sep 3, 2026

CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies

The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…

Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation

Moderate Court ruling Decided France · Aug 26, 2026

French Constitutional Council strikes down law banning social media for under‑15s

France’s top court invalidated the legislation that prohibited people under 15 from using social media. The Council found the ban infringed freedom of expression and the right to private life by imposing mandatory age verification. The…

Moderate Court ruling Decided France · Aug 14, 2026

French Constitutional Council strikes down law banning under‑15s from social media

On 14 August 2026 the French Constitutional Council invalidated Article 1 of the Act that would have barred minors under 15 from accessing online social media. The Council found the ban disproportionate, lacking individual assessment, and…

European Commission · Digital Services Act

Moderate Fine In effect France · Mar 13, 2026

French court upholds €40M GDPR fine against Criteo

The French Data Protection Authority (CNIL) fined Criteo €40 million for GDPR violations, including lack of valid consent, transparency, and failures to honor erasure and access rights. In March 2026, the Conseil d’État rejected Criteo’s…

CNIL · General Data Protection Regulation

Moderate Fine In effect France · Nov 27, 2025

CNIL fines Conde Nast €750,000 for cookie consent violations

The French data protection authority CNIL fined Conde Nast €750,000 for placing cookies on its Vanity Fair website without obtaining valid user consent. The authority also found the publisher failed to adequately inform users about the…

CNIL

Moderate Fine In effect France · Sep 4, 2025

CNIL fines Google €325 million for unsolicited Gmail advertising

The French data protection authority CNIL has issued a decision siding with privacy NGO noyb and fined Google €325 million for sending unsolicited advertising emails to Gmail users without consent. The authority also ordered Google to stop…

CNIL · ePrivacy Directive

Low Enforcement Filed France · Dec 12, 2024

noyb files complaint against BeReal for forced consent dark pattern in France

noyb has lodged a complaint with the French data protection authority (CNIL) alleging that BeReal uses a dark‑pattern consent banner that forces users to accept tracking for advertising. The complaint argues the consent is not freely…

CNIL · General Data Protection Regulation

Low Enforcement Filed France · Oct 22, 2024

noyb files complaint against Pinterest for unlawful tracking without consent

noyb lodged a complaint with the French data protection authority (CNIL) alleging that Pinterest tracks EU users for personalised advertising without obtaining opt‑in consent. The complaint cites a CJEU ruling that legitimate interest…

CNIL · General Data Protection Regulation

Low Enforcement Filed France · Sep 14, 2023

noyb files three complaints in France alleging illegal data sharing by Fnac, SeLoger, MyFitnessPal apps

noyb lodged complaints with the French data protection authority (CNIL) against the mobile apps of Fnac, SeLoger and MyFitnessPal, alleging they collect and share personal data without user consent. The complaints cite violations of the…

CNIL · ePrivacy Directive

Moderate Fine In effect France · Jun 22, 2023

French CNIL fines Criteo €40 million for GDPR violations

The French Data Protection Authority (CNIL) fined Criteo €40 million for violating the GDPR, including lack of valid consent, transparency, and failure to respect the right to erasure and access. The enforcement followed complaints filed…

CNIL · General Data Protection Regulation

Low Enforcement Filed France · Aug 24, 2022

noyb files complaint with CNIL over Gmail's unsolicited advertising emails

noyb.eu lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Gmail sends unsolicited advertising emails without user consent, contrary to the ePrivacy Directive and a CJEU ruling. The complaint cites…

CNIL · ePrivacy Directive

Moderate Data protection authority action In effect France · Apr 5, 2022

CNIL rules use of Google Analytics illegal and orders French sites to comply with GDPR

The French data protection authority (CNIL) decided that using Google Analytics violates the GDPR and ordered three French website controllers to bring their practices into compliance. The decision follows earlier Austrian DPA rulings and…

CNIL · General Data Protection Regulation

Low Enforcement Filed France · Apr 6, 2021

noyb files complaint to French CNIL over Google’s Android Advertising ID tracking without consent

noyb lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Android Advertising Identifier (AAID) is installed on Android phones without user consent. The complaint cites the e‑Privacy Directive’s…

CNIL · General Data Protection Regulation

Moderate Fine In effect France · Jun 19, 2020

French court upholds €50 million CNIL fine against Google

The French Data Protection Authority (CNIL) imposed a €50 million fine on Google for insufficient information and lack of valid consent for personalized ads. The Conseil d’État confirmed the CNIL's decision and affirmed its jurisdiction…

CNIL · General Data Protection Regulation

Low Enforcement Filed France · Dec 10, 2019

noyb files three GDPR complaints with CNIL over fake consent cookie banners on French sites

The privacy NGO noyb filed three formal complaints with the French Data Protection Authority (CNIL) alleging that CDiscount, Allocine.fr and Vanity Fair turn user rejections of cookies into "fake consent". The sites use the IAB…

CNIL · General Data Protection Regulation

Moderate Fine Announced France · Jun 21, 2019

CNIL fines Google €50 million for GDPR ‘forced consent’ violations

The French data protection authority (CNIL) announced a €50 million fine against Google for GDPR violations related to forced consent. The penalty stems from complaints filed by noyb.eu and La Quadrature du Net. The announcement was made…

CNIL · General Data Protection Regulation