← All Articles Cookies · CNIL 8 min read By the Sitetals Team Updated 6 September 2026

Cookie banners: rejecting as easy as accepting, what the CNIL's 2020 guidelines require

The banner slides up from the bottom of the screen. A large green "Accepter" button. Next to it, small and grey, a link that says "Paramétrer". A visitor who wants to say no has to click that link, wait for a panel to open, untick six purposes one by one, then hunt for a "Enregistrer" button. Meanwhile the page has already loaded the analytics script and the advertising pixel. This banner is common on French websites. It looks like a compliant banner; it is not one. This article explains what French law asks for, what the CNIL spelled out in its two 2020 texts, and how to fix an existing banner on a French site.

Disclaimer: this article is provided for information only and does not constitute legal advice. The texts cited are those in force at the time of writing; for a specific situation, consult a qualified legal professional.

Start here: the three-click test

Open your site in a private browsing window and answer three questions.

Is refusal one click away? A "Tout refuser" (reject all) button sits at the same level, in the same size and colour, as "Tout accepter" (accept all).
Is nothing set before the choice? In the browser's developer tools, the cookie list contains only technical cookies before any click.
Can the visitor change their mind? An icon or a "Gérer mes cookies" link is visible on every page, including after accepting.

Three yeses: your banner meets the core of what deliberation no. 2020-091 asks. One or more noes: the rest of this article tells you what to fix, in order.

What the law says

The starting point is not the GDPR but article 82 of the loi Informatique et Libertés (law no. 78-17 of 6 January 1978), France's transposition of the ePrivacy rules on terminal equipment. It asks for two things before anything is stored on, or read from, a user's device: "clear and complete" information about the purpose of the operation and the means of objecting to it, and then the user's consent, given after receiving that information. The article is about the device, not only about personal data.

Article 82 carves out two exceptions: operations whose "exclusive purpose" is to enable or facilitate electronic communication, and operations "strictly necessary" to provide an online service expressly requested by the user. Everything else needs consent.

The definition of consent comes from the GDPR, Article 4(11): a "freely given, specific, informed and unambiguous" indication of wishes, by a statement or "a clear affirmative action". Article 7 adds two conditions banners often ignore: the controller "shall be able to demonstrate" that consent was given (paragraph 1), and "it shall be as easy to withdraw as to give consent" (paragraph 3).

Takeaway: consent is an action by the user, taken before anything is set, informed, and reversible.

What the CNIL asks for in practice

The CNIL set out how it reads article 82 in two texts adopted on 17 September 2020: the guidelines (deliberation no. 2020-091) and the recommendation (deliberation no. 2020-092), which proposes practical arrangements and interface examples.

Nothing before the choice. The guidelines restate that article 82 requires consent "before any action" that stores or reads information. A consent-based tracker that loads with the page is set without a basis.
Rejecting as easy as accepting. Under the guidelines, expressing refusal must "require no action" from the user, or be an action "presenting the same degree of simplicity" as accepting. The recommendation illustrates this with two buttons "presented at the same level and in the same format", for instance "Tout accepter" and "Tout refuser".
Continuing to browse is not consent. Continuing to browse the site or "scrolling the page" are not clear affirmative actions that count as valid consent. Nor is a blanket acceptance of terms of use.
The cookie wall is not the default answer. Making access to the site conditional on accepting trackers "is likely to undermine, in some cases, the freedom of consent"; its lawfulness is assessed case by case. A site that uses one has to state clearly what refusal means for the visitor.
Minimum information before the choice. The identity of the controller or controllers, the purpose of each operation, how to accept or refuse, the consequences of the choice, and the existence of the right to withdraw. The list of companies setting trackers has to be complete, kept up to date, and reachable at the moment of choice.
Purpose by purpose. A single consent bundling several distinct purposes, with no purpose-by-purpose choice, is "likely to affect" freedom of choice. The recommendation suggests a "Personnaliser mes choix" button at the same level as the two global buttons.
Withdrawal as easy as giving. The recommendation suggests a settings module reachable "on every page of the site" through a "cookie" icon or a footer link.
Keep the proof. The controller has to be able to produce proof of valid consent "at any time". Suggested means, not exclusive: a timestamped screenshot of the banner for each version of the site, a timestamped hash of the consent code, or an archive of the consent tool's configurations.
Six months, then ask again. The recommendation asks for consent to be renewed "at appropriate intervals" and treats keeping the choice, "both consent and refusal", for six months as good practice. In practice: do not re-show the banner on every visit to someone who refused, and re-show it to everyone after six months.

Takeaway: the two texts ask for a symmetrical banner that acts only after the choice, and whose history you keep.

Trackers exempt from consent

Not every cookie needs a banner. The guidelines give examples of trackers that can be regarded as exempt under article 82: the cookie that stores the visitor's own banner choice; authentication trackers; those that remember a shopping basket; those that remember the language, where that personalisation is an expected part of the service; load-balancing trackers; and certain audience-measurement trackers, under conditions.

The audience-measurement case. The guidelines treat trackers whose purpose is limited to measuring the site's audience as strictly necessary to run it, and therefore not subject to prior consent, on three cumulative conditions: a purpose "strictly limited to measuring the audience" on "the publisher's exclusive behalf"; no "global tracking of the person's browsing" across different sites or apps; and "anonymous statistical data" only, with no cross-referencing against other processing and no transfer to third parties. The recommendation adds: tell users about these trackers in the privacy policy, cap their lifetime at thirteen months without automatic extension, and keep the data no longer than twenty-five months.

Takeaway: an analytics tool left on its default settings, sharing data with an advertising ecosystem, does not meet these conditions. Either it runs in an exempt configuration or it goes behind the banner.

What the banner shows, what the texts ask

What the banner shows	What the texts ask	Compliant?
An "Accepter" button and a "Paramétrer" link	Refusal "presenting the same degree of simplicity" as acceptance (guidelines 2020-091)	No
"By continuing to browse, you accept…"	A "clear affirmative action" (GDPR, Art. 4(11)); scrolling is not one (guidelines 2020-091)	No
The ad pixel loads with the page, the banner appears afterwards	Consent before anything is stored or read (art. 82 LIL)	No
"Tout accepter" and "Tout refuser", same size, same colour	Two buttons "at the same level and in the same format" (recommendation 2020-092)	Yes
Once accepted, the banner does not come back	Withdrawal "as easy" as giving (GDPR, Art. 7(3)); renewal, six months as good practice (recommendation 2020-092)	No
No banner; only a session cookie and a language cookie	Strictly necessary trackers, exempt (art. 82 LIL)	Yes

Fixing an existing banner, step by step

Inventory the trackers. Open the site in a private window without clicking anything and list every cookie and every third-party script that loads (the "Network" and "Application" tabs of the developer tools). Classify each one: strictly necessary, exempt audience measurement, or consent-based. Note which company sets it.
Block before the choice. In the tag manager or the CMS, make every consent-based script fire only on a "consent given for purpose X" trigger. A script left in the page's HTML loads no matter what. On WordPress, our WordPress and CNIL guide covers the plugins that handle this blocking.
Add the reject button. First screen: "Tout accepter", "Tout refuser", "Personnaliser mes choix", same level, same format. Remove any "by continuing to browse" wording. Closing the banner sets nothing.
Complete the information. A short list of purposes, each with a heading and one sentence. On the second screen, the list of companies setting trackers, with a link to each one's policy, and a mention of the right to withdraw. Link the banner to the privacy policy, which is a separate page from the mentions légales.
Set the durations. Keep the choice, accepted or refused, for six months, then show the banner again. Cap exempt audience-measurement trackers at thirteen months.
Make withdrawal visible. A "cookie" icon or a "Gérer mes cookies" link in the footer of every page that reopens the module and allows everything to be withdrawn in one click.
Build the proof. A timestamped screenshot of the banner for each version, an export of the tool's configuration, kept with the go-live date.
Test with a fresh profile. A browser profile never used on the site. Three passes: no click, after "Tout refuser", after "Tout accepter". Compare cookies and network requests with the inventory from step 1.

Takeaway: step 2 matters most. A "Tout refuser" button that blocks nothing gives the visitor a false assurance.

Checklist

Before any click, only strictly necessary or exempt audience-measurement trackers are present.
"Tout accepter" and "Tout refuser" are on the first screen, at the same level, in the same format.
No "by continuing to browse" wording; closing the banner does not count as acceptance.
The list of companies setting trackers is reachable from the banner and kept up to date.
The right to withdraw is mentioned; an icon or link allows it on every page.
The choice, accepted or refused, is kept for six months and then asked again.
Exempt audience-measurement trackers meet the three conditions and last at most thirteen months.
The fresh-profile test, desktop and mobile, was repeated after the last change to the site.

Check the third-party services your site loads

The free Sitetals check reviews your home page and reports, among other things, whether a legal notice page or a privacy policy page is missing or unreachable, and which third-party services your site loads. It is a starting point for the review described above, not a replacement for it.

Run the free check

Also worth reading:

Sources: Law no. 78-17 of 6 January 1978, article 82 · CNIL deliberation no. 2020-091 of 17 September 2020 (guidelines) · CNIL deliberation no. 2020-092 of 17 September 2020 (recommendation) · Regulation (EU) 2016/679, Articles 4 and 7 · CNIL, audience-measurement tools · Sitetals methodology.

Sitetals editorial team