Tag: Fines

• 16 Mar, 2026
• • GDPR

€487M in CNIL Fines 2025: What Your Analytics Actually Risks

On February 9, 2026, France's CNIL published its 2025 sanctions report. One number tells the story: €487 million in fines issued in a single year. That's nine times more than 2024. And it's no accident -- cookies and audience measurement tools now represent over a quarter of sanctions (21 out of 83). If you use Google Analytics, Hotjar, or any tracking tool on your website, you're potentially affected. Not because you're malicious. Simply because the rules have changed, enforcement has intensified, and "I didn't know" is no longer an acceptable defense. The two largest fines of 2025 target giants: Google (€325 million) and Shein (€150 million). But of the 83 sanctions issued, 67 targeted smaller organizations through simplified procedure. Amounts between €5,000 and €20,000. Less spectacular, but just as real for an SME or e-commerce business. This article decodes the 2025 CNIL report, identifies the three most common grounds for sanctions, and explains concretely what you risk with your current analytics setup. Because waiting for a formal notice to arrive is already too late. The 2025 CNIL Report in Numbers: Record High €487 Million: Nine Times More Than 2024 In 2024, the CNIL issued €55 million in fines. In 2025, that amount multiplied by nine. This explosion is explained by two record sanctions:Google: €325 million for Gmail advertisements without consent and cookies placed during Google account creation, without valid consent from French users. Shein: €150 million for cookies placed without consent on its e-commerce site.These two sanctions alone represent €475 million, or 97.5% of the total. But the remaining €12 million is distributed across 81 other decisions. And it's this "long tail" that directly concerns SMEs, startups, and web agencies. 83 Sanctions Issued, 67 via Simplified Procedure The CNIL rendered 259 decisions in 2025, including 83 effective sanctions. Among these 83 sanctions, 67 were issued via simplified procedure. This procedure, established in 2020, allows quick processing of cases without particular complexity, with fines capped at €20,000. Concretely, this means most sanctions don't target multinationals, but medium-sized actors: e-commerce sites, publishers, agencies, B2B SaaS. Organizations with neither dedicated legal departments nor budgets for specialized law firms. The CNIL's message is clear: compliance isn't negotiable, regardless of your size. The argument "we're too small to be audited" no longer holds. 21 Cookie-Related Sanctions: Over a Quarter of Total Of the 83 sanctions, 21 specifically concern failures to comply with cookie and tracker rules. That's 25% of the total, making it the second most common ground for sanctions after data security (data breaches, insufficient security measures). Analytics cookies -- those you install to measure your audience -- aren't spared. Even if your objective is legitimate (understanding where your traffic comes from, which pages work), the way you collect this data can be sanctioned. The three most commonly sanctioned types of violations are:Cookies placed without consent: Cookies are installed before the user clicks "Accept." Insufficient information: The consent banner doesn't clearly specify which cookies are placed and why. Refusal not respected: The user refuses cookies, but they continue to be read or aren't deleted.The Three Grounds for Sanctions That Affect Your Analytics Ground 1: Cookies Placed Before Consent This is the most frequent violation. You install Google Analytics (or equivalent) on your site. By default, the script loads as soon as the page displays, even before the consent banner appears. Result: cookies are placed and data collected before the user has given consent. Concrete example (American Express sanction, November 2025): Upon arriving at americanexpress.com/fr-fr/, several advertising cookies were placed before any interaction with the consent banner. Fine: €1.5 million. To avoid this trap, you must:Block the analytics script from loading until the user has consented. Use a Consent Management Platform (CMP) that manages this blocking automatically: OneTrust, Axeptio, Cookiebot, Didomi, etc. Verify regularly (at least quarterly) that blocking actually works, especially after each CMS or theme update.Ground 2: Insufficient or Deceptive Consent Banner The CNIL conducted over 40 online audits in 2024 following complaints targeting "deceptive" banners, designed to nudge users toward accepting cookies rather than making an informed choice. Most frequent defects:No visible "Reject" button: Only an "Accept" or "Customize" button is displayed. Refusing requires navigating through multiple sub-menus. Asymmetric buttons: The "Accept" button is large, colored, eye-catching, while the "Reject" button is small, grayed out, discreet. Vague information: The banner says "We use cookies to improve your experience," without specifying which ones, why, for how long. No distinction between cookies: Strictly necessary cookies (cart, login) aren't separated from analytics or advertising cookies.What's expected in 2026:A "Reject all" button as visible as "Accept all," with equivalent size and color. A clear list of purposes: "Audience measurement" (distinct from "Personalized advertising"). Information on cookie retention duration. A link to the privacy policy, accessible and readable.Ground 3: Consent Refusal Not Respected The user clicks "Reject," but cookies continue to be read or aren't deleted from the browser. This is exactly what American Express was sanctioned for: even after refusal, previously placed cookies continued to be read. This violation is particularly serious because it betrays user trust. They explicitly said "no," and you override it. To be compliant:When the user refuses, all non-strictly-necessary cookies must be deleted from the browser (via JavaScript). If the user previously accepted then changes their mind (consent withdrawal), cookies must be deleted immediately and their reading must cease. Modern CMPs handle this automatically, but you need to verify the configuration is correct.What You Actually Risk According to Your Profile SMEs: Between €5,000 and €20,000 via Simplified Procedure If you're a small organization (fewer than 50 employees, annual revenue under €10 million), you probably don't risk a multi-million fine. However, simplified procedure allows the CNIL to sanction quickly with amounts between €5,000 and €20,000. That may seem "reasonable" compared to Google's €325 million. But for an SME with tight cash flow, €15,000 in fines + compliance costs (GDPR consultant, banner redesign, technical audit) is a serious hit. And importantly, the sanction is often published. Your name, activity, identified violations: everything is visible on the CNIL website. The reputational impact can be costlier than the fine itself. E-commerce / SaaS: Risk of Intermediate Sanction (€50,000 to €500,000) If you collect data at scale (several tens of thousands of visitors per month, significant customer database), you're outside simplified procedure scope. The CNIL can then issue "intermediate" sanctions, according to violation severity and number of people affected. 2025 examples:Data transfer to social network (January 2026 sanction): €3.5 million for transmitting data of 10.5 million loyalty program members to a social network, without consent. France Travail: €5 million for data breach (insufficient security).If your e-commerce site uses Facebook, TikTok, or Google Ads pixels without obtaining prior consent, you're in a high-risk zone. Transmitting personal data (email, phone) to advertising platforms without consent is now sanctioned very harshly. Web Agencies / Freelancers: Liability as Processor If you're a developer, integrator, or web agency, you can be sanctioned as a processor under GDPR Article 28. Your liability is engaged if:You install tracking tools without informing your client of their GDPR obligations. You misconfigure a consent banner (script blocking not activated). You don't document implemented security measures.European DPAs have already sanctioned technical service providers. Your contract must specify:Who is responsible for what (client vs. provider). What technical measures you implement (script blocking, form masking, etc.). That you advise the client to consult a DPO or GDPR lawyer for legal aspects.And crucially: bill for compliance work. It's not "included" in a standard web development package. Analytics Tools Specifically in the Crosshairs Google Analytics: The Emblematic Case Google Analytics 4 (GA4) is the world's most-used tool. It's also the one posing the most compliance problems:Data transfers to the United States: Even though Google implemented "supplementary measures" after Privacy Shield invalidation, the CNIL (and other European authorities) consider that the risk of access by US authorities (FISA, CLOUD Act) persists.Data reuse by Google: Google can use data collected via GA4 to improve its own services, including advertising. Even if you disable data sharing, certain processing persists.Very broad default collection: GA4 collects far more data than necessary for simple audience measurement (advertising identifiers, device ID, precise geolocation if authorized).Consequence: Several companies received formal notices for using Google Analytics without valid legal basis. Some were forced to stop GA4 completely, others had to implement strict consent (no exemption possible). If you use GA4, you must:Obtain explicit consent (no exemption possible). Disable all data sharing features with Google. Anonymize IP addresses (GA4 native feature, but verify it's activated). Document your impact assessment (DPIA) concerning transfers outside the EU.Or switch to a European alternative that doesn't pose these structural problems. Hotjar, Clarity, Fullstory: The Next Wave Session replay tools (Hotjar, Microsoft Clarity, Fullstory) are in the CNIL's crosshairs. A public consultation is ongoing until April 22, 2026 to regulate these practices. These tools record the entire user journey: clicks, mouse movements, scrolling, form inputs. It's far more intrusive than a simple analytics cookie. If you use Hotjar without:Obtaining explicit consent. Automatically masking all sensitive form fields (passwords, banking details, health data). Limiting sampling (recording 100% of sessions is disproportionate). Reducing retention period (30 days maximum).You're in clear violation. And given 2025 fines for simple cookies, imagine the amounts for non-compliant session replay. Advertising Pixels (Meta, TikTok, LinkedIn) The Facebook pixel (Meta Pixel), TikTok pixel, LinkedIn Insight tag: these scripts transmit personal data (hashed email address, phone number, browsing behavior) to advertising platforms, often located outside the EU. January 2026 sanction: €3.5 million for transmitting data of 10.5 million loyalty program members to a social network, without consent. "Catch-all" consent ("We use cookies to improve your experience") isn't sufficient. You need specific consent for each advertising platform. If you use these pixels, your consent banner must explicitly mention: "Data sharing with Meta (Facebook, Instagram) for targeted advertising." And users must be able to refuse without affecting their site access. Concrete Solutions to Reduce Risk to Zero (or Nearly) Solution 1: Use a Consent-Exempt Tool The CNIL allows a consent exemption for audience measurement tools that meet 10 strict criteria. In summary:Purpose strictly limited to measurement (no advertising, no data sharing). Anonymized or heavily pseudonymized data. No cross-referencing with other files. Limited retention period (13 months for cookies, 25 months for data). Hosting and processing in Europe.If you use a tool compliant with these criteria (Matomo configured in exempt mode, AT Internet, or a privacy-first solution by design), you don't need a consent banner for analytics. You eliminate 90% of the risk. Warning: Google Analytics 4 cannot benefit from this exemption, even with strict configuration. US transfers and reuse by Google structurally disqualify it. Solution 2: Strictly Configure Your CMP If you must continue with Google Analytics or other tools requiring consent, your CMP must be impeccable:Block all scripts until consent is given. Use a tag management system (Google Tag Manager, OneTrust, Cookiebot) that manages blocking automatically.Display a "Reject all" button as visible as "Accept all," with identical size and color. Since January 2026, this is a quasi-formal obligation (CNIL recommendation on cross-device consent).Clearly separate purposes: Don't mix "Audience measurement," "Personalized advertising," "Social networks," and "Product improvement." Each purpose should be a distinct checkbox.Respect refusal: If the user refuses, delete the cookies (not just "stop reading them"). Test regularly with your browser's developer tools.Document everything: Screenshots of your configuration, purpose justification, impact assessment if you transfer data outside the EU.Solution 3: Audit and Correct Before Inspection The CNIL doesn't warn before an inspection. One day, you receive an email: "The CNIL has decided to conduct an inspection of your website. You have 24 hours to provide us with the following documents." It's too late to correct. If you wait for this moment to achieve compliance, you'll be sanctioned based on the state found at the time of inspection, not what you did afterward. Our advice: Audit your site now. Free tools:Cookie Scanner (Cookiebot, OneTrust): Scan your site to identify all placed cookies. CNIL Cookie Checker: Tool developed by the CNIL itself (available for Chrome). Browser developer tools: "Application" tab > "Cookies." Verify nothing is placed before consent.Correct identified anomalies. If you don't know how, budget €2,000 to €5,000 for a GDPR consultant or specialized agency. It's cheaper than a €15,000 fine. What Changes in 2026 and Beyond End of CNIL's "Validated" Tools List Until December 2025, the CNIL published an indicative list of analytics tools considered compliant with consent exemption (Matomo, AT Internet, etc.). This list was removed in January 2026. Now, it's up to you to self-assess your tool. The CNIL published a self-assessment online tool in July 2025 that guides you through the 10 criteria. You must document this self-assessment and keep it in case of inspection. Consequence: Even if you use Matomo, you must verify your configuration meets the criteria. Installing Matomo isn't enough. You must disable certain features (precise geolocation, cross-site tracking, etc.) to stay within the exemption framework. Intensified Cookie Audits in 2026 The CNIL's cookie action plan, launched in 2019, continues in 2026. Over 40 audits were conducted in 2024, focusing on dark patterns in consent banners. In 2026, the CNIL announced it would continue these audits, particularly on:High-traffic e-commerce sites. Media publishers (heavy reliance on programmatic advertising). B2B SaaS using advertising pixels for acquisition.If your site attracts over 100,000 visitors per month, or you're in a "sensitive" sector (health, finance, media), your chances of being audited increase mechanically. Digital Omnibus: Toward Relaxation? The European Commission proposed a regulatory simplification package called "Digital Omnibus" in November 2025. Among the proposals: a "whitelist" of analytics tools considered "low-risk," which could benefit from simplified consent (opt-out rather than opt-in). But warning: This text is still under discussion in the European Parliament and Council. Adoption likely mid-2026, application 2027 at earliest. Meanwhile, current rules (strict opt-in for everything not exempt) fully apply. Don't bet on hypothetical relaxation to delay your compliance. 2026 audits will be based on 2026 rules, not 2027 ones. Conclusion: 2026 Isn't 2019 In 2019, when the CNIL's cookie action plan launched, many thought: "They'll never audit everyone, we have time." Seven years later, €487 million in fines were issued in a single year. The "time" has run out. If you use Google Analytics, Hotjar, advertising pixels, or any tracking tool, you have two options. Either achieve strict compliance now: consent, CMP, script blocking, documentation. Or switch to tools designed for compliance, freeing you from this permanent mental and legal burden. Inaction costs more than action. A €15,000 fine + sanction publication + emergency compliance costs are far more expensive than a €3,000 preventive audit and migration to a compliant tool. 2025 numbers aren't an accident. They're the new normal. Adapt now, or pay later. For those seeking an analytics approach respecting GDPR minimization and transparency principles by design, you can join Pomelo's waitlist to be informed of the launch. FAQ What's the difference between normal and simplified CNIL procedure? Simplified procedure was introduced in 2020 to quickly process cases without particular complexity. Fines are capped at €20,000 and the procedure is faster (a few months instead of 1-2 years). In 2025, 67 out of 83 sanctions were issued via this procedure, showing it mainly targets SMEs and medium-sized organizations. Normal procedure, longer, is reserved for complex or serious cases, with fines up to €20 million or 4% of global annual turnover. Can I still use Google Analytics 4 in 2026? Yes, technically you can continue using Google Analytics 4, but under strict conditions: you must obtain explicit user consent (no exemption possible), disable all data sharing features with Google, anonymize IP addresses, and document an impact assessment on data transfers to the United States. In practice, many organizations consider these constraints make GA4 less attractive and prefer migrating to European alternatives like Matomo or cookieless solutions to avoid legal and technical complexity. How much does analytics compliance cost for an SME? For a typical SME (showcase site or e-commerce with 10,000 to 100,000 visitors/month), budget between €2,000 and €5,000 for complete compliance: initial cookie and tracker audit (€500-1,000), installation and configuration of professional CMP (€500-1,500), drafting or updating privacy policy (€500-1,000), and possibly migration to compliant analytics tool (€500-2,000 depending on chosen tool). If you have complex needs (multiple advertising pixels, session replay, transfers outside EU), budget can rise to €10,000-15,000. It's an investment, but significantly less than a €15,000 fine + reputational impact. What signals can trigger a CNIL audit? Several factors increase your chances of being audited: high traffic volume (> 100,000 visitors/month), a complaint from a user or association (like NOYB), a sensitive sector (health, finance, media, large-scale e-commerce), presence in the news (funding round, media controversy), or having been previously sanctioned. The CNIL also conducts thematic audits: in 2024-2025, the focus was on cookies and dark patterns in consent banners. In 2026, audits continue on this theme, with particular attention to session replay tools. Does the consent exemption for audience measurement apply to all analytics tools? No, the exemption only applies to tools that strictly meet the 10 criteria defined by the CNIL: purpose limited to audience measurement (no advertising), anonymized or heavily pseudonymized data, no cross-referencing with other files, limited retention period (13 months for cookies, 25 months for logs), hosting in Europe, clear user information, and no transfers outside EU. Google Analytics 4 cannot benefit from this exemption due to transfers to the United States and data reuse by Google. Matomo can benefit if properly configured (exempt mode activated). Since January 2026, there's no longer an official list of validated tools: you must self-assess your tool via the CNIL online tool. SourcesCNIL, "Sanctions and corrective measures: CNIL's actions in 2025", February 9, 2026 (https://www.cnil.fr/en/investigation-powers-cnil/sanctions-issued-cnil) CNIL, "Cookies and advertisements inserted between emails: GOOGLE fined 325 million euros by the CNIL", September 1, 2025 (https://www.cnil.fr/en/cookies-and-advertisements-inserted-between-emails-google-fined-325-million-euros-cnil) CNIL, "Cookies deposited without consent: the CNIL sanctions SHEIN with a fine of 150 million euros", September 2025 CNIL, "Cookies: AMERICAN EXPRESS fined €1.5 million by the CNIL", November 27, 2025 (https://www.cnil.fr/en/cookies-american-express-fined-eu15-million-cnil) CNIL, "Transfer of data to a social network for advertising purposes: the CNIL imposed a fine of €3.5 million", January 22, 2026 (https://www.cnil.fr/en/transfer-data-social-network-advertising-purposes-cnil-imposed-fine-eu35-million) La Cité Apprenante, "Bilan CNIL : Cookies, surveillance des salariés et sécurité des données, principaux sujets des sanctions en 2025", February 2026 (https://www.laciteapprenante.com/bilan-cnil-cookies-surveillance-des-salaries-et-securite-des-donnees-principaux-sujets-des-sanctions-en-2025/) Haas Avocats, "Sanctions CNIL et cookies : comment sont fixées les amendes ?", January 21, 2026 (https://www.haas-avocats.com/protection-des-donnees/sanctions-cnil-et-cookies-comment-sont-fixees-les-amendes/)