EN FR

Tag: Cookies

All blog posts with this tag.

€487M in CNIL Fines 2025: What Your Analytics Actually Risks

€487M in CNIL Fines 2025: What Your Analytics Actually Risks

On February 9, 2026, France's CNIL published its 2025 sanctions report. One number tells the story: €487 million in fines issued in a single year. That's nine times more than 2024. And it's no accident -- cookies and audience measurement tools now represent over a quarter of sanctions (21 out of 83). If you use Google Analytics, Hotjar, or any tracking tool on your website, you're potentially affected. Not because you're malicious. Simply because the rules have changed, enforcement has intensified, and "I didn't know" is no longer an acceptable defense. The two largest fines of 2025 target giants: Google (€325 million) and Shein (€150 million). But of the 83 sanctions issued, 67 targeted smaller organizations through simplified procedure. Amounts between €5,000 and €20,000. Less spectacular, but just as real for an SME or e-commerce business. This article decodes the 2025 CNIL report, identifies the three most common grounds for sanctions, and explains concretely what you risk with your current analytics setup. Because waiting for a formal notice to arrive is already too late. The 2025 CNIL Report in Numbers: Record High €487 Million: Nine Times More Than 2024 In 2024, the CNIL issued €55 million in fines. In 2025, that amount multiplied by nine. This explosion is explained by two record sanctions:Google: €325 million for Gmail advertisements without consent and cookies placed during Google account creation, without valid consent from French users. Shein: €150 million for cookies placed without consent on its e-commerce site.These two sanctions alone represent €475 million, or 97.5% of the total. But the remaining €12 million is distributed across 81 other decisions. And it's this "long tail" that directly concerns SMEs, startups, and web agencies. 83 Sanctions Issued, 67 via Simplified Procedure The CNIL rendered 259 decisions in 2025, including 83 effective sanctions. Among these 83 sanctions, 67 were issued via simplified procedure. This procedure, established in 2020, allows quick processing of cases without particular complexity, with fines capped at €20,000. Concretely, this means most sanctions don't target multinationals, but medium-sized actors: e-commerce sites, publishers, agencies, B2B SaaS. Organizations with neither dedicated legal departments nor budgets for specialized law firms. The CNIL's message is clear: compliance isn't negotiable, regardless of your size. The argument "we're too small to be audited" no longer holds. 21 Cookie-Related Sanctions: Over a Quarter of Total Of the 83 sanctions, 21 specifically concern failures to comply with cookie and tracker rules. That's 25% of the total, making it the second most common ground for sanctions after data security (data breaches, insufficient security measures). Analytics cookies -- those you install to measure your audience -- aren't spared. Even if your objective is legitimate (understanding where your traffic comes from, which pages work), the way you collect this data can be sanctioned. The three most commonly sanctioned types of violations are:Cookies placed without consent: Cookies are installed before the user clicks "Accept." Insufficient information: The consent banner doesn't clearly specify which cookies are placed and why. Refusal not respected: The user refuses cookies, but they continue to be read or aren't deleted.The Three Grounds for Sanctions That Affect Your Analytics Ground 1: Cookies Placed Before Consent This is the most frequent violation. You install Google Analytics (or equivalent) on your site. By default, the script loads as soon as the page displays, even before the consent banner appears. Result: cookies are placed and data collected before the user has given consent. Concrete example (American Express sanction, November 2025): Upon arriving at americanexpress.com/fr-fr/, several advertising cookies were placed before any interaction with the consent banner. Fine: €1.5 million. To avoid this trap, you must:Block the analytics script from loading until the user has consented. Use a Consent Management Platform (CMP) that manages this blocking automatically: OneTrust, Axeptio, Cookiebot, Didomi, etc. Verify regularly (at least quarterly) that blocking actually works, especially after each CMS or theme update.Ground 2: Insufficient or Deceptive Consent Banner The CNIL conducted over 40 online audits in 2024 following complaints targeting "deceptive" banners, designed to nudge users toward accepting cookies rather than making an informed choice. Most frequent defects:No visible "Reject" button: Only an "Accept" or "Customize" button is displayed. Refusing requires navigating through multiple sub-menus. Asymmetric buttons: The "Accept" button is large, colored, eye-catching, while the "Reject" button is small, grayed out, discreet. Vague information: The banner says "We use cookies to improve your experience," without specifying which ones, why, for how long. No distinction between cookies: Strictly necessary cookies (cart, login) aren't separated from analytics or advertising cookies.What's expected in 2026:A "Reject all" button as visible as "Accept all," with equivalent size and color. A clear list of purposes: "Audience measurement" (distinct from "Personalized advertising"). Information on cookie retention duration. A link to the privacy policy, accessible and readable.Ground 3: Consent Refusal Not Respected The user clicks "Reject," but cookies continue to be read or aren't deleted from the browser. This is exactly what American Express was sanctioned for: even after refusal, previously placed cookies continued to be read. This violation is particularly serious because it betrays user trust. They explicitly said "no," and you override it. To be compliant:When the user refuses, all non-strictly-necessary cookies must be deleted from the browser (via JavaScript). If the user previously accepted then changes their mind (consent withdrawal), cookies must be deleted immediately and their reading must cease. Modern CMPs handle this automatically, but you need to verify the configuration is correct.What You Actually Risk According to Your Profile SMEs: Between €5,000 and €20,000 via Simplified Procedure If you're a small organization (fewer than 50 employees, annual revenue under €10 million), you probably don't risk a multi-million fine. However, simplified procedure allows the CNIL to sanction quickly with amounts between €5,000 and €20,000. That may seem "reasonable" compared to Google's €325 million. But for an SME with tight cash flow, €15,000 in fines + compliance costs (GDPR consultant, banner redesign, technical audit) is a serious hit. And importantly, the sanction is often published. Your name, activity, identified violations: everything is visible on the CNIL website. The reputational impact can be costlier than the fine itself. E-commerce / SaaS: Risk of Intermediate Sanction (€50,000 to €500,000) If you collect data at scale (several tens of thousands of visitors per month, significant customer database), you're outside simplified procedure scope. The CNIL can then issue "intermediate" sanctions, according to violation severity and number of people affected. 2025 examples:Data transfer to social network (January 2026 sanction): €3.5 million for transmitting data of 10.5 million loyalty program members to a social network, without consent. France Travail: €5 million for data breach (insufficient security).If your e-commerce site uses Facebook, TikTok, or Google Ads pixels without obtaining prior consent, you're in a high-risk zone. Transmitting personal data (email, phone) to advertising platforms without consent is now sanctioned very harshly. Web Agencies / Freelancers: Liability as Processor If you're a developer, integrator, or web agency, you can be sanctioned as a processor under GDPR Article 28. Your liability is engaged if:You install tracking tools without informing your client of their GDPR obligations. You misconfigure a consent banner (script blocking not activated). You don't document implemented security measures.European DPAs have already sanctioned technical service providers. Your contract must specify:Who is responsible for what (client vs. provider). What technical measures you implement (script blocking, form masking, etc.). That you advise the client to consult a DPO or GDPR lawyer for legal aspects.And crucially: bill for compliance work. It's not "included" in a standard web development package. Analytics Tools Specifically in the Crosshairs Google Analytics: The Emblematic Case Google Analytics 4 (GA4) is the world's most-used tool. It's also the one posing the most compliance problems:Data transfers to the United States: Even though Google implemented "supplementary measures" after Privacy Shield invalidation, the CNIL (and other European authorities) consider that the risk of access by US authorities (FISA, CLOUD Act) persists.Data reuse by Google: Google can use data collected via GA4 to improve its own services, including advertising. Even if you disable data sharing, certain processing persists.Very broad default collection: GA4 collects far more data than necessary for simple audience measurement (advertising identifiers, device ID, precise geolocation if authorized).Consequence: Several companies received formal notices for using Google Analytics without valid legal basis. Some were forced to stop GA4 completely, others had to implement strict consent (no exemption possible). If you use GA4, you must:Obtain explicit consent (no exemption possible). Disable all data sharing features with Google. Anonymize IP addresses (GA4 native feature, but verify it's activated). Document your impact assessment (DPIA) concerning transfers outside the EU.Or switch to a European alternative that doesn't pose these structural problems. Hotjar, Clarity, Fullstory: The Next Wave Session replay tools (Hotjar, Microsoft Clarity, Fullstory) are in the CNIL's crosshairs. A public consultation is ongoing until April 22, 2026 to regulate these practices. These tools record the entire user journey: clicks, mouse movements, scrolling, form inputs. It's far more intrusive than a simple analytics cookie. If you use Hotjar without:Obtaining explicit consent. Automatically masking all sensitive form fields (passwords, banking details, health data). Limiting sampling (recording 100% of sessions is disproportionate). Reducing retention period (30 days maximum).You're in clear violation. And given 2025 fines for simple cookies, imagine the amounts for non-compliant session replay. Advertising Pixels (Meta, TikTok, LinkedIn) The Facebook pixel (Meta Pixel), TikTok pixel, LinkedIn Insight tag: these scripts transmit personal data (hashed email address, phone number, browsing behavior) to advertising platforms, often located outside the EU. January 2026 sanction: €3.5 million for transmitting data of 10.5 million loyalty program members to a social network, without consent. "Catch-all" consent ("We use cookies to improve your experience") isn't sufficient. You need specific consent for each advertising platform. If you use these pixels, your consent banner must explicitly mention: "Data sharing with Meta (Facebook, Instagram) for targeted advertising." And users must be able to refuse without affecting their site access. Concrete Solutions to Reduce Risk to Zero (or Nearly) Solution 1: Use a Consent-Exempt Tool The CNIL allows a consent exemption for audience measurement tools that meet 10 strict criteria. In summary:Purpose strictly limited to measurement (no advertising, no data sharing). Anonymized or heavily pseudonymized data. No cross-referencing with other files. Limited retention period (13 months for cookies, 25 months for data). Hosting and processing in Europe.If you use a tool compliant with these criteria (Matomo configured in exempt mode, AT Internet, or a privacy-first solution by design), you don't need a consent banner for analytics. You eliminate 90% of the risk. Warning: Google Analytics 4 cannot benefit from this exemption, even with strict configuration. US transfers and reuse by Google structurally disqualify it. Solution 2: Strictly Configure Your CMP If you must continue with Google Analytics or other tools requiring consent, your CMP must be impeccable:Block all scripts until consent is given. Use a tag management system (Google Tag Manager, OneTrust, Cookiebot) that manages blocking automatically.Display a "Reject all" button as visible as "Accept all," with identical size and color. Since January 2026, this is a quasi-formal obligation (CNIL recommendation on cross-device consent).Clearly separate purposes: Don't mix "Audience measurement," "Personalized advertising," "Social networks," and "Product improvement." Each purpose should be a distinct checkbox.Respect refusal: If the user refuses, delete the cookies (not just "stop reading them"). Test regularly with your browser's developer tools.Document everything: Screenshots of your configuration, purpose justification, impact assessment if you transfer data outside the EU.Solution 3: Audit and Correct Before Inspection The CNIL doesn't warn before an inspection. One day, you receive an email: "The CNIL has decided to conduct an inspection of your website. You have 24 hours to provide us with the following documents." It's too late to correct. If you wait for this moment to achieve compliance, you'll be sanctioned based on the state found at the time of inspection, not what you did afterward. Our advice: Audit your site now. Free tools:Cookie Scanner (Cookiebot, OneTrust): Scan your site to identify all placed cookies. CNIL Cookie Checker: Tool developed by the CNIL itself (available for Chrome). Browser developer tools: "Application" tab > "Cookies." Verify nothing is placed before consent.Correct identified anomalies. If you don't know how, budget €2,000 to €5,000 for a GDPR consultant or specialized agency. It's cheaper than a €15,000 fine. What Changes in 2026 and Beyond End of CNIL's "Validated" Tools List Until December 2025, the CNIL published an indicative list of analytics tools considered compliant with consent exemption (Matomo, AT Internet, etc.). This list was removed in January 2026. Now, it's up to you to self-assess your tool. The CNIL published a self-assessment online tool in July 2025 that guides you through the 10 criteria. You must document this self-assessment and keep it in case of inspection. Consequence: Even if you use Matomo, you must verify your configuration meets the criteria. Installing Matomo isn't enough. You must disable certain features (precise geolocation, cross-site tracking, etc.) to stay within the exemption framework. Intensified Cookie Audits in 2026 The CNIL's cookie action plan, launched in 2019, continues in 2026. Over 40 audits were conducted in 2024, focusing on dark patterns in consent banners. In 2026, the CNIL announced it would continue these audits, particularly on:High-traffic e-commerce sites. Media publishers (heavy reliance on programmatic advertising). B2B SaaS using advertising pixels for acquisition.If your site attracts over 100,000 visitors per month, or you're in a "sensitive" sector (health, finance, media), your chances of being audited increase mechanically. Digital Omnibus: Toward Relaxation? The European Commission proposed a regulatory simplification package called "Digital Omnibus" in November 2025. Among the proposals: a "whitelist" of analytics tools considered "low-risk," which could benefit from simplified consent (opt-out rather than opt-in). But warning: This text is still under discussion in the European Parliament and Council. Adoption likely mid-2026, application 2027 at earliest. Meanwhile, current rules (strict opt-in for everything not exempt) fully apply. Don't bet on hypothetical relaxation to delay your compliance. 2026 audits will be based on 2026 rules, not 2027 ones. Conclusion: 2026 Isn't 2019 In 2019, when the CNIL's cookie action plan launched, many thought: "They'll never audit everyone, we have time." Seven years later, €487 million in fines were issued in a single year. The "time" has run out. If you use Google Analytics, Hotjar, advertising pixels, or any tracking tool, you have two options. Either achieve strict compliance now: consent, CMP, script blocking, documentation. Or switch to tools designed for compliance, freeing you from this permanent mental and legal burden. Inaction costs more than action. A €15,000 fine + sanction publication + emergency compliance costs are far more expensive than a €3,000 preventive audit and migration to a compliant tool. 2025 numbers aren't an accident. They're the new normal. Adapt now, or pay later. For those seeking an analytics approach respecting GDPR minimization and transparency principles by design, you can join Pomelo's waitlist to be informed of the launch. FAQ What's the difference between normal and simplified CNIL procedure? Simplified procedure was introduced in 2020 to quickly process cases without particular complexity. Fines are capped at €20,000 and the procedure is faster (a few months instead of 1-2 years). In 2025, 67 out of 83 sanctions were issued via this procedure, showing it mainly targets SMEs and medium-sized organizations. Normal procedure, longer, is reserved for complex or serious cases, with fines up to €20 million or 4% of global annual turnover. Can I still use Google Analytics 4 in 2026? Yes, technically you can continue using Google Analytics 4, but under strict conditions: you must obtain explicit user consent (no exemption possible), disable all data sharing features with Google, anonymize IP addresses, and document an impact assessment on data transfers to the United States. In practice, many organizations consider these constraints make GA4 less attractive and prefer migrating to European alternatives like Matomo or cookieless solutions to avoid legal and technical complexity. How much does analytics compliance cost for an SME? For a typical SME (showcase site or e-commerce with 10,000 to 100,000 visitors/month), budget between €2,000 and €5,000 for complete compliance: initial cookie and tracker audit (€500-1,000), installation and configuration of professional CMP (€500-1,500), drafting or updating privacy policy (€500-1,000), and possibly migration to compliant analytics tool (€500-2,000 depending on chosen tool). If you have complex needs (multiple advertising pixels, session replay, transfers outside EU), budget can rise to €10,000-15,000. It's an investment, but significantly less than a €15,000 fine + reputational impact. What signals can trigger a CNIL audit? Several factors increase your chances of being audited: high traffic volume (> 100,000 visitors/month), a complaint from a user or association (like NOYB), a sensitive sector (health, finance, media, large-scale e-commerce), presence in the news (funding round, media controversy), or having been previously sanctioned. The CNIL also conducts thematic audits: in 2024-2025, the focus was on cookies and dark patterns in consent banners. In 2026, audits continue on this theme, with particular attention to session replay tools. Does the consent exemption for audience measurement apply to all analytics tools? No, the exemption only applies to tools that strictly meet the 10 criteria defined by the CNIL: purpose limited to audience measurement (no advertising), anonymized or heavily pseudonymized data, no cross-referencing with other files, limited retention period (13 months for cookies, 25 months for logs), hosting in Europe, clear user information, and no transfers outside EU. Google Analytics 4 cannot benefit from this exemption due to transfers to the United States and data reuse by Google. Matomo can benefit if properly configured (exempt mode activated). Since January 2026, there's no longer an official list of validated tools: you must self-assess your tool via the CNIL online tool. SourcesCNIL, "Sanctions and corrective measures: CNIL's actions in 2025", February 9, 2026 (https://www.cnil.fr/en/investigation-powers-cnil/sanctions-issued-cnil) CNIL, "Cookies and advertisements inserted between emails: GOOGLE fined 325 million euros by the CNIL", September 1, 2025 (https://www.cnil.fr/en/cookies-and-advertisements-inserted-between-emails-google-fined-325-million-euros-cnil) CNIL, "Cookies deposited without consent: the CNIL sanctions SHEIN with a fine of 150 million euros", September 2025 CNIL, "Cookies: AMERICAN EXPRESS fined €1.5 million by the CNIL", November 27, 2025 (https://www.cnil.fr/en/cookies-american-express-fined-eu15-million-cnil) CNIL, "Transfer of data to a social network for advertising purposes: the CNIL imposed a fine of €3.5 million", January 22, 2026 (https://www.cnil.fr/en/transfer-data-social-network-advertising-purposes-cnil-imposed-fine-eu35-million) La Cité Apprenante, "Bilan CNIL : Cookies, surveillance des salariés et sécurité des données, principaux sujets des sanctions en 2025", February 2026 (https://www.laciteapprenante.com/bilan-cnil-cookies-surveillance-des-salaries-et-securite-des-donnees-principaux-sujets-des-sanctions-en-2025/) Haas Avocats, "Sanctions CNIL et cookies : comment sont fixées les amendes ?", January 21, 2026 (https://www.haas-avocats.com/protection-des-donnees/sanctions-cnil-et-cookies-comment-sont-fixees-les-amendes/)

GDPR analytics checklist: 10 compliance checks before installing any tracking tool

GDPR analytics checklist: 10 compliance checks before installing any tracking tool

You just installed an analytics tool on your website. The script is live, data is flowing, the dashboard is coming to life. Everything looks fine. Except nobody on the team checked whether this setup complies with European data protection law. And this is not a minor oversight: in 2025, France's data protection authority (CNIL) imposed a record 487 million euros in fines, with 21 sanctions specifically targeting cookies and trackers. Cookies were the single largest enforcement category, ahead of data security and employee surveillance. The problem is rarely the tool itself. It is how the tool is configured, documented, and used. A tool that is compliant "on paper" can become non-compliant in three clicks if the default settings are left untouched. This checklist gives you ten concrete points to verify the GDPR compliance of your analytics setup, whether you use Google Analytics 4, Matomo, Plausible, or any other tool. It is written for website owners, marketing leads, and DPOs who want to make sure their audience measurement does not create an avoidable legal risk.1. Is the purpose strictly limited to audience measurement? This is the foundation of any analytics compliance assessment. Article 5(1)(b) of the GDPR requires that personal data be collected for specified, explicit, and legitimate purposes. For an analytics tool, this means data must be used exclusively to understand how visitors interact with the site: pages viewed, traffic sources, load times, navigation errors. Nothing else. In practice, scope creep is common. Many analytics tools let you enable remarketing, ad targeting, or CRM cross-referencing. The moment any of these features is activated, you leave the territory of strict audience measurement. You lose eligibility for the consent exemption (more on this in point 2) and must deploy a full cookie consent banner. What to verify: Document the exact purpose in your Record of Processing Activities (Article 30 GDPR). If the stated purpose reads "audience measurement and marketing optimization," it is too broad. The wording should be limited to producing anonymous statistics for the exclusive benefit of the site publisher. If you use analytics alongside an advertising tool (Meta Pixel, Google Ads), both processing activities must be listed separately in your records, with distinct legal bases.2. Is the legal basis correctly identified? The GDPR provides six possible legal bases for processing personal data (Article 6). For analytics, two scenarios dominate. Scenario A: consent exemption. If your tool is configured to meet the strict criteria set by your national data protection authority (in France, the CNIL), you may rely on legitimate interest (Article 6(1)(f)) combined with the exemption under Article 5(3) of the ePrivacy Directive (transposed in each EU member state). In this case, no cookie banner is needed for analytics. This is the most favorable scenario, which we detail in our guide to the CNIL consent exemption. Scenario B: consent. If your tool collects data for purposes beyond strict measurement (profiling, advertising, third-party sharing), user consent is mandatory before any tracker is placed. This consent must be freely given, informed, specific, and unambiguous under Article 7 GDPR. In practice, this requires a compliant cookie banner with a "Reject" button as prominent as the "Accept" button. The CNIL regularly sanctions non-compliant consent mechanisms: in 2025, fines of 325 million and 150 million euros were imposed for cookie-related violations. What to verify: Determine which scenario applies to you. If you are unsure, it is almost certainly Scenario B. And if you claim the exemption, be prepared to demonstrate it in writing. Since January 2026, the CNIL no longer publishes an official list of "approved" tools. Each publisher must now prove their own compliance, notably through the self-assessment framework published by the CNIL. Other EU data protection authorities (such as the ICO in the UK, the DSB in Austria, and the AEPD in Spain) apply similar principles under the ePrivacy Directive, though specific criteria may vary.3. What cookies and trackers are actually being placed? Many sites claim to use "cookieless" analytics while their configuration actually deposits trackers in the browser. The reverse also happens: a properly configured tool paired with a CMP (Consent Management Platform) that triggers undeclared third-party scripts on its own. The only way to know what is really happening is to check for yourself. What to verify: Open your site in a private browsing window. Open the developer tools (F12 in Chrome or Firefox), go to the "Application" tab, then "Cookies." Note every cookie deposited before any interaction with a consent banner. Also check the "Network" tab to identify requests sent to third-party domains. If cookies are placed before consent and they do not correspond to a tracker strictly necessary for the site to function, that is a violation. If your analytics tool is supposed to work without cookies but you see a persistent identifier in localStorage or sessionStorage, this may still constitute a tracker under the ePrivacy Directive. For a more thorough audit, tools like Cookiebot Scanner or browser extensions such as Ghostery can automatically scan the trackers deployed by your site.4. Does the tracker lifespan comply with regulatory limits? The CNIL is explicit: the lifespan of an audience measurement tracker must not exceed 13 months. And this duration must not be automatically renewed on subsequent visits. This rule is one of the most frequently ignored. Google Analytics 4, for example, renews the duration of its cookies by default on every visit. This behavior is incompatible with the consent exemption. Matomo offers a similar option that must be manually disabled. Other EU authorities apply comparable limits. The general principle across the EU is that tracker lifespans must be proportionate and limited to what is necessary for meaningful audience comparison over time. What to verify: Check your tool's documentation for the default cookie duration. Confirm that the active configuration does not extend trackers beyond the applicable limit. If your tool allows it, set a shorter duration (some privacy-first tools use 24-hour or 30-day windows, which are compliant by design). Tools that operate without persistent cookies, such as the cookieless solutions described in our comparison, bypass this constraint entirely since there is no tracker to expire.5. Is data retention within the authorized limits? Tracker lifespan (point 4) and data retention are two separate topics. The CNIL recommends that information collected through analytics trackers be retained for a maximum of 25 months. Beyond that period, raw data (individual events, session identifiers) must be deleted or irreversibly aggregated. Aggregated statistics (total visits per month, top pages) can be kept longer, as they no longer contain personal data. What to verify: Check the data retention settings in your analytics tool. Google Analytics 4 offers configurable durations (2 months or 14 months for user-level data). Matomo allows automatic deletion of raw logs. If your tool does not offer automatic purging, set up a documented manual procedure. The regulatory recommendation of periodic review means you must also be able to justify why you retain data for the duration you have chosen. If 6 months meets your needs, do not configure 25 months "just in case." The principle of data minimization applies to duration, not just volume.6. Is data hosted within the European Economic Area? This is the question that triggered a wave of enforcement actions across Europe in 2022, when several data protection authorities (including the CNIL, the Austrian DSB, and the Italian Garante) ruled that using Google Analytics resulted in data transfers to the United States that were incompatible with the GDPR, following the invalidation of the EU-US Privacy Shield. Since July 2023, the EU-US Data Privacy Framework (DPF) has restored a legal basis for transfers. But this framework faces legal challenges (NOYB announced a challenge before the CJEU upon its adoption), and there is no guarantee it will survive, given that its two predecessors (Safe Harbor and Privacy Shield) were both struck down. What to verify: Identify where the data collected by your analytics tool is physically hosted. If the provider is US-based, check whether it is certified under the DPF and document this verification. For maximum legal certainty, choose a provider with exclusively European hosting, which makes the transfer question moot. The CNIL notes that when using a tool involving transfers, a server-side proxy can serve as a supplementary measure, provided it is correctly configured to prevent any identifiable data from reaching the provider's servers. As we explain in our article on the 5 essential analytics KPIs, the question is not purely legal: European hosting also reduces latency and improves dashboard performance.7. Is the data processor governed by a compliant contract? Article 28 of the GDPR requires that any processing carried out by a processor on behalf of a controller be governed by a specific contract or legal act. This is commonly known as a DPA (Data Processing Agreement). For analytics, the processor is your tool provider (Google, Matomo Cloud, Plausible, Fathom, etc.). The DPA must specify the processing purposes, the nature of the data processed, security measures, sub-processors, and breach notification obligations. What to verify: Have you signed (or accepted online) a DPA with your analytics provider? If so, read it. Pay particular attention to three sensitive points. First: does the provider commit to not reusing the data for its own purposes? This is a disqualifying criterion for the consent exemption. The CNIL explicitly cites the privacy policies of several major analytics offerings that indicate data reuse for their own services. Second: is the list of sub-processors accessible and up to date? You need to know who processes your data downstream. Third: are the data breach notification clauses compliant with Article 33 GDPR (notification within 72 hours)?8. Is user information complete and accessible? Even if you benefit from the consent exemption, you are not exempt from informing your visitors. The CNIL recommends that users be informed about the deployment of these trackers, for example through the site's privacy policy. Article 13 of the GDPR lists the mandatory information: identity of the controller, purposes, legal basis, recipients, retention periods, data subject rights (access, rectification, erasure, objection). For analytics, you should also specify the tool name, the nature of data collected (pages viewed, visit duration, device type, approximate geolocation, etc.), and the DPO contact details if applicable. What to verify: Reread your "Privacy Policy" or "Legal Notice" page. Is analytics mentioned? Is the information current (correct tool, correct purposes, correct retention periods)? If your privacy policy is a generic template mentioning Google Analytics when you switched to Matomo two years ago, that is a breach of the information obligation. A practical tip: add a dedicated "Audience measurement" section to your privacy policy, specifying the tool name, the legal basis, tracker duration, and data retention period. This level of clarity is what separates a compliant site from one that merely displays a banner.9. Is data cross-referencing excluded? This is one of the strictest criteria for the consent exemption: data collected by the analytics tool must not be cross-referenced with other processing activities, nor shared with third parties. This concretely prohibits several common practices: matching analytics data with a CRM to identify users, sharing identifiers with an advertising platform, using the same cookie for analytics and retargeting, or sending data to a social network to build lookalike audiences. It also prohibits cross-site tracking: the same identifier cannot be used to measure navigation across different domains. If you manage multiple sites, each property must be isolated with independent trackers. What to verify: Review the active integrations in your analytics tool. Have you enabled the link between GA4 and Google Ads? Between GA4 and BigQuery with CRM data? These connections, even if not actively exploited, are enough to disqualify the exemption. If you use UTM parameters or campaign tags in your URLs, verify that this information stays within the analytics perimeter and is not shared with third-party tools. The principle is simple: what goes into analytics must stay in analytics. For practical guidance on measuring campaign performance without cross-referencing data, see our article on SEO without Google Analytics.10. Is the configuration documented and auditable? This is the point everyone forgets. GDPR compliance is not a fixed state. It is an ongoing process that must be documented, auditable, and periodically reviewed. Since January 2026, the CNIL's shift in approach is clear: it no longer validates tools. It is up to each publisher, with support from its provider if needed, to demonstrate that the deployed configuration is compliant. The self-assessment tool published by the CNIL in July 2025 is now the central mechanism for verifying exemption eligibility. What to verify: Maintain an internal document (even a simple one) describing your analytics configuration: tool name, version, active settings, purposes, legal basis, retention periods, hosting location, processors. Date it. Update it with every change. If the regulator ever asks, or if a user exercises their right of access, you need to be able to respond within minutes. Schedule an annual audit of your analytics configuration. Verify that settings have not changed after a tool update, that third-party integrations have not been enabled by a team member, and that your retention periods are still being respected. Finally, if you use an external agency to manage your analytics, make sure that compliance responsibility is clearly assigned in your contract. The data controller is you, not your agency.Quick verification grid Here are the 10 points condensed. If you can answer "yes" to each question, your analytics setup is solid. Every "no" or "I don't know" identifies a risk to address.Is the purpose strictly limited to audience measurement? Is the legal basis identified and documented? Do you know exactly which cookies and trackers are being placed? Does the tracker lifespan comply with the 13-month limit? Is raw data retained for 25 months or less? Is data hosted in the EEA, or is the transfer legally covered? Is a DPA signed with your provider, with no data reuse? Does your privacy policy mention analytics? Is no cross-referencing performed with other processing activities? Is the configuration documented and regularly audited?Two common mistakes to avoid "My tool is compliant, so my site is compliant." No. A tool can be compliant in one configuration and non-compliant in another. Compliance depends on your settings, not on the logo on the box. Matomo can be compliant or not depending on its configuration. Google Analytics can be used with supplementary measures (proxy, restrictive settings) or triggered only after consent. It is the configuration that matters. As we discuss in our analysis of data obesity, the instinct to "collect everything by default" is precisely what the GDPR was designed to counter. "I'm too small to be audited." The CNIL's simplified procedure, operational since 2022, allows for rapid handling of straightforward cases, including against very small businesses. Fines are capped at 20,000 euros under this procedure, but they do happen: in 2025, the CNIL issued 67 decisions through this track. The risk is not proportional to your size. It is proportional to your visibility and the number of complaints received.Conclusion: compliance as an advantage, not a burden Verifying these ten points takes a few hours, not a few weeks. And the payoff goes well beyond legal compliance. A site with properly configured analytics inspires greater trust. The data collected is more reliable, because it is not polluted by unnecessary scripts or phantom trackers. The technical footprint is lighter. And if you meet the conditions for the consent exemption, you eliminate the cookie banner for analytics, which directly improves user experience and data completeness, as we explain in our guide to the consent exemption. Compliance is not an obstacle to measurement. It is the foundation on which trustworthy audience measurement is built.FAQ Does my personal site or blog need this checklist? Yes, as soon as you collect browsing data through any analytics tool, even a free or self-hosted one. The GDPR applies to anyone processing personal data of European residents, regardless of the organization's size. That said, if your tool places no cookies, collects no IP addresses, and enables no identification (even indirect), the practical risk is very low. Can Google Analytics 4 be GDPR-compliant? Technically, it is possible to configure GA4 in ways that significantly reduce risk: IP anonymization, disabling Google signals, no link to Google Ads, consent obtained before the script fires. However, GA4 is not eligible for the consent exemption in its standard configuration, because Google states that it reuses data for its own services. You will therefore need a cookie banner and will only collect data from visitors who accept. What is the difference between anonymization and pseudonymization? Pseudonymization replaces a direct identifier (name, email) with an indirect one (hash, token). The data remain personal data because re-identification is theoretically possible. Anonymization renders re-identification impossible and irreversible, even through cross-referencing. Only truly anonymized data fall outside the scope of the GDPR. This distinction is critical for analytics: pseudonymized data remain subject to the GDPR and must comply with retention limits. How do I know if my tool qualifies for the consent exemption? Since January 2026, the CNIL no longer publishes a list of validated tools. Your solution provider can perform a self-assessment using the framework published by the CNIL in July 2025 and provide you with a compliance attestation. It is then your responsibility as the publisher to verify that your actual configuration matches that assessment. Other EU authorities apply similar principles; check with your national DPA for specific guidance. When in doubt, the safest approach is to obtain consent. How often should I re-audit my analytics configuration? At minimum once a year, or whenever a significant change occurs: tool update, new third-party integration, change of provider, change of purpose. The CNIL recommends periodic review of retention periods, which implies at least an annual documented review.SourcesSource: CNIL, "Cookies: solutions pour les outils de mesure d'audience," deliberation of July 4, 2025 (https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience) Source: CNIL, "Mesurer la fréquentation de vos sites web et de vos applications" (https://www.cnil.fr/fr/mesurer-la-frequentation-de-vos-sites-web-et-de-vos-applications) Source: CNIL, Self-assessment tool for audience measurement solutions, July 2025 (https://www.cnil.fr/sites/default/files/2025-07/outil_d_auto-evaluation_mesure_d_audience.pdf) Source: CNIL, "Mesure d'audience et transferts de données: comment mettre son outil en conformité avec le RGPD" (https://www.cnil.fr/fr/mesure-daudience-et-transferts-de-donnees-comment-mettre-son-outil-de-mesure-daudience-en-conformite) Source: L'Usine Digitale, "Avec 487 millions d'euros d'amendes en 2025, la CNIL sanctionne moins mais frappe beaucoup plus fort," February 9, 2026 (https://www.usine-digitale.fr/reglementation/gdpr-rgpd/avec-487-millions-deuros-damendes-en-2025-la-cnil-sanctionne-moins-mais-frappe-beaucoup-plus-fort) Source: Optimal Ways, "Nouvelles règles CNIL sur les solutions de mesure d'audience," December 2025 (https://www.optimalways.com/fr/2025/09/cnil-consentement-mesure-audience/)