A compliant cookie banner: what the French regulator really expects

Cookie banners are often added in a hurry, with a big "Accept" button and a "Settings" link lost at the bottom. That is exactly what the CNIL, the French data protection authority, fines. Yet the rules are simple to follow.

Is a banner needed?

Only if your website sets trackers that require consent: advertising, embedded social networks, most analytics tools. A website using only technical cookies (cart, session, language) does not need to ask. Some audience measurement tools can also be exempt when configured according to the conditions published by the CNIL. In that case, no banner: a note in the privacy policy is enough.

The rules of a compliant banner

• No tracker before the choice: the scripts concerned load only after explicit consent.
• Refusing as easily as accepting: a "Reject all" button at the same level and with the same visual weight as "Accept all".
• Clear information: what the trackers are for, who sets them, and a link to the details.
• No forced consent: scrolling on or closing the banner does not count as consent.
• A choice remembered, then asked again: the CNIL recommends keeping the choice, refusal included, for a reasonable time (six months is the example it gives) before asking again.
• A choice that can be changed at any time: a "Manage cookies" link reachable from every page, often in the footer.

Accessibility counts too

The banner must work with a keyboard, be read by a screen reader and not hide all the content on mobile. A banner that traps focus or hides the reject button is both a legal and an accessibility problem.

And technically?

The most robust approach is for your analytics or advertising scripts not to exist in the page until consent is given, then to load them in response to a consent event. Store the choice so the question is not asked on every page.

The most common traps

• The reject button hidden behind "Settings" or in a grey link: the most frequent reason for fines.
• Pre-ticked boxes in the settings panel: consent must come from the person's own action.
• Embedded videos and maps that set trackers as soon as they display: replace them with an image and a button that loads the service only on click.
• A banner in every language but half translated: the information must be understandable.
• A refusal that is not remembered: asking again on every page amounts to forcing consent.

Checking your banner in five minutes

Open your website in a private window, with the browser's developer tools. Before clicking anything, look at the cookies and network requests: no analytics or advertising service should appear. Click "Reject all", browse three pages, then check again: still nothing. Finally, reopen the panel from the footer link and change your mind: the website must respect the new choice without loading the trackers that were refused. If any of these checks fails, fix it before anything else: it is the part regulators test first.

To go faster

Our cookie banners follow these rules: refusing as easy as accepting, choice by purpose, memory and a management link, in HTML, React and WordPress. Our website templates already include theirs.