French GDPR Cookie Notice Banner Template

Yes, as soon as a website sets non-essential trackers — third-party analytics, advertising pixels, social-media buttons, etc. The legal basis is Article 82 of France's Loi Informatique et Libertés (Law No. 78-17 of 6 January 1978). Strictly necessary cookies such as shopping-cart sessions, login authentication and load-balancing are exempt and may be set without consent. This obligation applies to any website accessible in France, regardless of where the business is incorporated.

Yes. The CNIL requires that refusing trackers be exactly as easy as accepting them: the 'Reject all' button must appear at the same visual level with comparable prominence and require the same number of clicks as 'Accept all'. A banner that only presents 'Accept all' at the first screen — relegating refusal to a secondary menu — is non-compliant under Deliberation No. 2020-091 of 17 September 2020.

The CNIL recommends a maximum validity of 13 months (Deliberation No. 2020-091 of 17 September 2020). After 13 months, consent must be sought again. Individual trackers themselves must also not outlive 13 months. The user's choice — acceptance or refusal — must be stored for the full period so visitors are not prompted again at every visit during those 13 months.

Not as a blanket rule. The CNIL assesses their legality case by case, in particular examining whether a genuine alternative means of access exists. Conditioning all access to a site on accepting tracking cookies remains legally risky. Where no real alternative is offered, consent obtained under such a wall is unlikely to be considered freely given — a core requirement of Article 7 GDPR.

Violations of consent conditions fall under Article 83(5) of the GDPR: fines of up to 4 % of global annual turnover or €20,000,000 — whichever is the higher amount. In practice the CNIL has imposed penalties ranging from several tens to several hundreds of millions of euros against companies that failed to offer a 'Reject all' button as prominent as 'Accept all'.

Yes, in its standard configuration. Only audience-measurement trackers that are strictly statistical, not cross-referenced with other processing and not used for cross-site tracking can be exempt — for example a Matomo installation configured to anonymise data and set no persistent cookies. A standard GA4 setup with advertising features, or the Meta Pixel, cannot benefit from the exemption and requires prior consent.