By country

Cookie Policy Generator France

GDPR plus the Loi Informatique et Libertés, CNIL cookie doctrine and the mentions légales duty.

Generate your cookie policy Read the cookie policy guide

French cookie enforcement is the most developed in Europe, and it is enforcement of banner behaviour rather than of policy wording. The cookie policy’s job is to describe a banner that already meets the CNIL recommendation.

France applies GDPR through the Loi Informatique et Libertés, and the CNIL is one of the most active regulators in Europe on the specific question of cookies. Its recommendation that refusing must be as simple as accepting was backed by fines in the tens and hundreds of millions against the largest advertising platforms, and it has continued down the long tail since.

The CNIL also publishes référentiels - sector reference frameworks for HR data, health research, customer management and more. They are not binding in the way a regulation is, but departing from one is something you are expected to justify.

Alongside data protection, French e-commerce carries its own disclosure regime: mentions légales identifying the publisher and host, CGV setting sale terms, and Code de la consommation rules on the fourteen-day withdrawal right and the two statutory guarantees.

What a cookie policy in France has to cover

A per-cookie table with finalité, durée and éditeur for each entry
Symmetric accept and refuse, documented as such
Whether you rely on the audience-measurement exemption and the exact configuration that supports it
Consent lifetime of around six months and how choices are re-collected
Third-party tags including social embeds, video players and chat widgets

How France actually moves personal data

Audience measurement under the CNIL exemption

France allows a narrow consent exemption for strictly first-party, non-shared audience measurement configured to CNIL parameters. Standard Google Analytics does not qualify; a properly configured Matomo instance can.

Prospection commerciale

B2C email marketing needs prior opt-in; B2B is permitted on a professional address where the message relates to the person’s role and an opt-out is offered. The distinction is French-specific and frequently missed.

Health and wellbeing data

French rules on health data are stricter than the GDPR baseline, and hosting health data on behalf of others requires an HDS-certified host.

HR and recruitment records

The CNIL HR référentiel sets expected retention - typically two years for unsuccessful applicants - and restricts what may be collected during recruitment.

Cookie consent proof

The CNIL asks operators to demonstrate consent. In its enforcement decisions the evidence examined was the live banner behaviour, not the wording of the cookie policy.

Third parties the draft will ask you about

Stripe · Lydia · Chronopost and Colissimo · OVHcloud · Scaleway · Matomo · Sendinblue/Brevo · Salesforce · Google Workspace

The rules that apply

Loi Informatique et Libertés + GDPR

The French implementation, including the age of digital consent set at fifteen and specific rules on health and research data.

CNIL cookie recommendation

Refusal as easy as acceptance, no consent by continued browsing, consent lifetime of about six months before re-asking, and a documented audience-measurement exemption if you rely on it.

Mentions légales

Publisher identity, director of publication, and the host’s name and address must be published - a duty from the LCEN, separate from privacy law.

Code de la consommation

Fourteen-day withdrawal, the garantie légale de conformité and the garantie des vices cachés, plus mandatory pre-contractual information.

CNIL référentiels

Sector frameworks covering customer management, HR, health and more. Divergence is permitted but has to be reasoned.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

The French checklist

Publish mentions légales
Identity of the publisher, the director of publication, and the host’s name, address and telephone number.
Configure the banner symmetrically
Accept and refuse at the same level, same visual weight, same number of clicks. Store the choice for roughly six months.
Decide honestly whether the analytics exemption applies
If it does not, analytics fires only after consent.
Set the age of digital consent to fifteen
Below that, parental authorisation is required for consent-based services.
Publish CGV before checkout
The general conditions of sale must be accessible and acceptable before the order is confirmed, with a payment-obligation button.

Where this usually goes wrong

A banner where "Tout accepter" is a button and refusal is a link

This is the exact configuration the CNIL fined. Symmetry is the test.

Claiming the audience-measurement exemption while sharing data

The exemption dies the moment the measurement data is used for anything else or shared with the provider for its own purposes.

Missing mentions légales

Publisher, director of publication and host details are required by law and are trivially checkable by anyone.

English-only notices for a French audience

The Toubon law and Article 12 transparency both point the same way: if you sell in France, the notice should be in French.

Treating B2B prospection as unrestricted

It is permitted without prior consent only where the message relates to the recipient’s professional function and an opt-out is present in every message.

Frequently asked questions

Does my privacy policy have to be in French?

If you target French consumers, yes in substance. Article 12 requires intelligible language for the audience and French consumer law reinforces it. A French version alongside English is the safe configuration.

Can I use Google Analytics in France?

The CNIL has issued formal notices over standard Google Analytics configurations and transfers. It is possible to use analytics lawfully with consent and appropriate transfer safeguards, but the consent-free exemption is designed around tools that do not share data, not around GA.

How long can cookie consent last?

The CNIL recommends re-asking after about six months, and treats an indefinitely stored acceptance as a problem. Refusals should be remembered for a comparable period so the banner does not nag.

What are mentions légales?

A statutory legal notice identifying who publishes the site, who is responsible for its content, and who hosts it. It is separate from the privacy policy and from the CGV, and all three are expected.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.