#
Cookies/trackers and cross-context advertising well evidenced; opt-out signals, clean rooms/DCR and direct marketing remain gaps.
Sub-modules (6)
Cookies And TrackersGreen
CNIL's guidelines/recommendation require a clear positive consent act, easy withdrawal and equal ease of refusal; consolidated January 2026 and supplemented by 2026 multi-device recommendations.
Claims (2):
- CLM-FR-a10021t7 (claim on file)
- CLM-FR-a10022u8 (claim on file)
Dark PatternsAmber
CNIL identifies 'cookie walls' (conditioning access on tracker acceptance) as a distinct compliance-risk pattern under GDPR consent-validity standards.
Claims (1):
- CLM-FR-a10023v9 (claim on file)
Opt Out SignalsRed
No FR-specific Global-Privacy-Control-style opt-out-signal findings surfaced this cycle.
Absence provenance: unavailable. Searched: unavailable.
Clean Rooms And DcrRed
No FR-specific clean-room/data-collaboration-room findings surfaced this cycle.
Absence provenance: unavailable. Searched: unavailable.
Cross Context AdvertisingGreen
CNIL treats GDPR-governed advertising-data processing and Article-82 tracker-deposit rules as separate legal/jurisdictional regimes, avoiding double sanction for identical conduct.
Claims (1):
- CLM-FR-a10024w0 (claim on file)
Direct MarketingRed
No FR-specific direct-marketing consent/suppression findings beyond general cookie consent rules surfaced this cycle.
Absence provenance: unavailable. Searched: unavailable.
AdTech & Commercial Privacy
CNIL's final recommendation on email tracking pixels, published 14 April 2026, set a hard compliance deadline: organisations were required to obtain explicit consent from existing subscribers, or stop tracking them, by 14 July 2026, with no transitional period at all for contacts collected from 14 April 2026 onward. As of the current cycle, that deadline has passed, meaning any organisation that had not obtained the required explicit consent by 14 July 2026 is now operating outside CNIL's stated compliance expectation for email-tracking-pixel use.
The absence of a transitional period for newly-collected contacts is a notably strict feature of the recommendation relative to typical phased-implementation approaches, since it applies the full consent requirement immediately to any contact acquired after the recommendation's publication date, even though the overall compliance deadline for existing subscribers extended a further three months. This recommendation reflects CNIL's continuing focus on granular consent mechanics in commercial email and tracking contexts, consistent with its broader 2026 enforcement-priority theme of information and transparency obligations.
Outlook
The key marker to watch is whether CNIL follows the passed 14 July 2026 deadline with enforcement action against organisations found not to have obtained the required consent, which would be the first concrete enforcement test of this specific recommendation.