France

Other Developments

The CNIL consolidated its cookie and tracker guidelines and recommendation in January 2026, supplemented by 2026 recommendations on multi-device consent. The authority continues to require that consent to trackers be a clear positive act, freely revocable, with refusal exactly as easy as acceptance. The CNIL is understood to identify cookie walls, meaning the conditioning of site access on tracker acceptance, as a distinct compliance-risk pattern under GDPR consent-validity standards. The CNIL is understood to treat GDPR-governed advertising-data processing and Article 82 tracker-deposit rules as separate legal and jurisdictional regimes, avoiding double sanction for the same conduct. The CNIL processed 539 health-data-warehouse authorisation applications in 2025. The CNIL operates a sector-specific authorisation gate for health-data warehouses, such as IQVIA's LRX and EMR warehouses, rather than a blanket data-localisation mandate. The technical référentiel that Arcom must adopt for pornography-site age verification under the SREN law remains at consultation stage; the CNIL opined on the draft on 26 September 2024, favouring privacy-preserving proof-of-majority methods over facial recognition. The G7 group of data protection authorities, meeting in Paris in June 2026, is understood to have adopted a declaration on privacy-preserving age verification and a set of children's-protection principles. The EDPB is understood to have adopted a common breach-notification template together with generative-AI anonymisation, web-scraping and blockchain guidance. The CNIL has sanctioned the scraping-based creation of a facial-recognition database as unlawful Article 9 GDPR biometric processing, and treats biometric-identification cameras as excluded from its general smart-camera guidance. The CNIL and its EU peer authorities are reported to have called for prohibiting AI systems that categorise individuals by inferred protected characteristics such as ethnicity, sex, and political or sexual orientation, though this appears to be an advocacy position rather than an adopted rule.

Cross-Monitor Connections

The CNIL's treatment of banks and insurers as paradigm cases triggering mandatory DPO designation through large-scale client-monitoring activity intersects with financial-crime and data-sharing obligations tracked by the financial-integrity monitor. The Free Mobile and Free telecoms sanctions may also bear on payments-specific subscriber data flows tracked by the world-payments monitor. The EU AI Act's 2 August 2026 transparency-obligation date and its interface with GDPR data protection impact assessments are primarily AI-Act-first developments; readers seeking the regulation-specific analysis should consult the artificial-intelligence monitor, while this brief retains the data-protection angle.

Outlook

The trajectory in France points toward continued high-materiality enforcement of accountability, security and breach-notification duties, alongside a widening interface between GDPR and the incoming EU AI Act. The health-data pseudonymisation question tested in the IQVIA decision, and the unresolved status of France's collective-redress mechanism for data protection claims, both remain open threads for future cycles.

Outlook

France's regulatory posture is tightening: sustained CNIL sanction activity and the incoming EU AI Act transparency-obligation date together signal an environment of expanding scrutiny across enforcement, algorithmic governance and health-data reuse, even as evidentiary gaps persist around cross-border transfer practice and collective redress.