The sanctions imposed on ORANGE, SHEIN, CONDE NAST, and AMERICAN EXPRESS reveal a significant evolution in the CNIL's cookies enforcement method.
Key takeaways:
These sanctions reflect a now distinctly more technical enforcement approach, indicating four major trends:
→ systematic monitoring of network traffic,
→ strict verification of the effectiveness of user choices,
→ increased accountability for publishers regarding their technical architecture, including when they rely on industry standards,
→ and a restrictive interpretation of exemptions.
1. Before 2025: the CNIL's monitoring focused mainly on the user interface and consent
Between 2020 and 2022, the CNIL mainly checked the following points:
• Refusal had to be as simple as acceptance.
• Information on the purposes had to be clear.
• No non-essential cookies should be placed prior to the user's choice.
• The labels and choice paths should not mislead the user.
In short : a control focused on the consent collection mechanism, with some occasional technical checks, but without a comprehensive systematic analysis of the underlying technical architecture.
The CNIL ensured that cookie banners respected the main principles: button symmetry, clarity of information, absence of Dark Patterns. The underlying technical flows — HTTP requests, automatic cookie readings, propagation of withdrawal to partners — were not systematically analyzed.
This approach encouraged compliance that was essentially declarative, based on UX more than on technical reality.
2. In 2025: the CNIL systematically verifies the technical effectiveness of user choices
The CNIL now systematically verifies the technical effectiveness of user choices by finely analyzing network flows.
🔷 What is a HAR file and how does the CNIL use it?
HAR (HTTP Archive) files allow recording all network interactions of a web page, thus revealing the cookies actually placed.
Concretely, the CNIL analyzes HAR files during its checks to verify in detail each HTTP request, each cookie placed or read, each call to a third-party domain.
🔷 Automatic reading of cookies: a broad interpretation by the CNIL
The CNIL adopts a broad interpretation of reading operations: the reading of a cookie on the user's terminal can occur automatically, as soon as a request is sent to the server, independently of any voluntary action by the site publisher. Even if the publisher does not actively use the data in a cookie, the simple fact that it is transmitted automatically in an HTTP request constitutes a “reading” subject to consent.
Even “passive” reading is punishable: regardless of script deactivation, the lack of effective data use, or the existence of purge mechanisms on browsers.
Only the reality of the flows visible in the HAR file counts, regardless of the actual use of the data by the publisher. If the cookie is present in the network flows, the breach is characterized.
This approach is based on an objective assessment of compliance, based on the observation of technical flows and not on the declared intentions of the publisher.
3. Withdrawal of consent: strict control of expected technical solutions
🔷 Technical effectiveness of withdrawal: a strict requirement
The 2024-2025 sanctions reveal that many websites continued to read cookies (including first-party cookies) even after a user withdrew consent. This demonstrates a failure to effectively process the withdrawal, which is intrinsically linked to the obligation of obtaining valid consent in the first place.
The CNIL reiterates that once consent is withdrawn, all reading or writing of trackers must cease, including those generated automatically.
🔷 Technical Solutions Recommended by the CNIL
To this end, the CNIL has identified several technical solutions:
- Change the expiration date of cookies : return a “set-cookie” header with a past expiration date to invalidate the cookie and prevent it from being read by network requests;
- Delete cookies via a local script : delete cookies without an “HttpOnly” attribute using a script executed locally via the browsers' “cookie” APIs; or
- Block HTTP requests to third-party domains.
Publishers must be able to demonstrate that after consent withdrawal, no further reading or writing of trackers is triggered in technical flows, including those triggered automatically.
🔷 The Three Pillars of Effective Consent Withdrawal
This requirement for the technical effectiveness of withdrawal is particularly demanding because it necessitates:
- Immediate Technical Action : the withdrawal cannot simply be recorded in a database for later consideration. It must block all read/write operations instantly.
- Coordination with third party partners The publisher must ensure that third-party domains also stop reading their cookies after removal. This involves mechanisms for propagating the withdrawal signal (via TCF or others).
- Technical proof The publisher must be able to demonstrate, with support from HAR files, that the withdrawal is effective. Declarations of intent are no longer enough.
In practice, the withdrawal of consent should be treated as a technical mechanism with immediate effect, and not as a simple change of preference recorded on the interface side.
4. The IAB TCF and GDPR compliance: why the standard is not enough
The CNIL considers that the use of TCF (Transparency & Consent Framework) of the IAB, an advertising standard adopted by many publishers, does not exempt the publisher from technical expertise and transparency regarding the tracers actually registered.
🔷 The Condé Nast case: a turning point for the TCF
In the sanction pronounced against the company publishing the site “vanityfair.fr”, the CNIL considers that the publisher should have, at a minimum, referred the user to the IAB rules to explain the technical choices implemented with regard to the required consents or exemptions.
This clarification is essential because it puts an end to a widespread belief: using a CMP (Consent Management Platform) certified TCF does not automatically guarantee compliance with the CNIL.
🔷 The responsibilities of the publisher despite the TCF
The publisher remains responsible for:
- Verifying that the cookies actually placed correspond to user choices even if the CMP transmits consent signals correctly, some partners may not respect them.
- Provide clear and complete information : The TCF imposes presentation constraints (particularly on "purposes" and "functionalities"), but the publisher must ensure that the user truly understands what they are agreeing to. If certain "features" are presented as "still active" even though they require consent, the information is misleading.
- Refer to IAB rules if necessary : When the TCF imposes complex technical choices (for example, certain grouped purposes), the publisher must explain or refer to the IAB documentation to enable informed consent.
The use of a TCF-based CMP does not exempt the publisher from its responsibility to sufficiently and intelligibly inform the user about the technical rules actually implemented.
5. Capping advertising and A/B testing : First sanctions and strict interpretation of exemptions
🔷 Capping advertising: an advertising purpose requiring consent
In 2025, the CNIL issued its first sanction for the deposit of cookies related to Capping advertising andA/B testing without user consent, based on its 2020 guidelines, recommendations, and FAQ.
Many publishers considered that the Capping improved the user experience (by avoiding excessive repetition of advertisements) and could therefore benefit from an exemption under "browsing comfort." The CNIL's decision: Capping remains an advertising purpose, therefore subject to prior consent, regardless of the perceived benefit for the user.
🔷 A/B testing : strictly controlled exemptions
The exemption for audience measurement is strictly regulated and only valid for statistical analyses, over a limited period of time (recommendation: 13 months maximum), without cross-site monitoring and for the exclusive account of the publisher. A cookie fromA/B testing with an identifier that persists over 10 years, allowing extended individual follow-up, goes beyond this framework and requires consent.
These sanctions send a clear signal: exemptions should not be interpreted extensively. If the purpose or duration exceeds the intended scope, consent becomes mandatory again.
Conclusion: “cookie” compliance is now more technical
Remember: the CNIL's “cookie” controls have become more technical. Compliance is no longer assessed based on what the user sees, but on real technical flows.
Website publishers must now take a rigorous technical approach, systematically check their network flows, and ensure that their consent management solutions actually work, beyond appearances.
CNIL investigations and sanctions relating to cookies increasingly rely on in-depth technical assessments. Odoné assists companies during CNIL investigations and enforcement proceedings.
Would you like to review your cookie compliance or are you currently subject to a CNIL investigation? Contact us.
Checklist: Checkpoints for cookie compliance in 2026
→ HAR flow analysis : check that your HAR files do not reveal any cookies placed before consent.
→ Immediate withdrawal : test that withdrawing consent instantly blocks any reading/writing of cookies.
→ Coordination with third parties : check that your partners respect the withdrawal signals.
→ TCF information : if you use TCF, refer to the IAB rules for complex choices.
→ CMP Audit : don't just rely on your CMP, check for real technical compliance.
→ Capping Advertiser : get consent for all capping cookies.
→ A/B testing : limit the duration to a maximum of 13 months and avoid cross-site monitoring.
→ Technical documentation : keep proof of compliance (HAR files, configurations).
Frequently asked questions about cookies and the CNIL
🔸 What is a HAR file and why does the CNIL use it?
The CNIL analyzes HAR (HTTP Archive) files during its online checks to verify in detail each HTTP request, each cookie placed or read, each call to a third party domain.
HAR files are technical evidence of what is actually happening on a website, regardless of what is displayed to the user.
🔸 Does the IAB TCF ensure GDPR compliance?
No This clarification puts an end to a widespread belief: using a TCF certified CMP does not automatically guarantee compliance with the CNIL. In particular, the use of a CMP based on the TCF does not exempt the publisher from its responsibility in terms of the obligation to inform the user in a sufficient and intelligible manner about the technical rules actually implemented.
🔸 Cookies from Capping Do advertising require consent?
Yes. The Capping remains an advertising purpose; it is therefore subject to prior consent, regardless of the perceived benefit for the user.
🔸 How to prove the effectiveness of the withdrawal of consent?
The publisher must be able to demonstrate that after the withdrawal of consent, no more reading or writing of trackers is triggered in technical flows, including those triggered automatically.
The publisher must be able to demonstrate, with support from HAR files, that the withdrawal is effective.
🔸 What is the maximum duration for a cookie ofA/B testing without consent?
The exemption for audience measurement is strictly regulated and only valid for statistical analyses, over a limited period (recommendation: 13 months maximum), without cross-site monitoring and for the exclusive account of the publisher.
