Analytics Without a Banner: The CNIL Exemption and the Four Conditions That Hold It Up

Your analytics runs with no banner, no consent prompt, and no complaints. Is that lawful, or have you just not been caught yet? In France, the answer is sometimes lawful, and the reason is a specific exemption with four conditions and a checklist. Outside that frame, the same setup is a violation with the banner removed. The exemption is real. It is also narrow, and most of the sites claiming it are outside it.

The four conditions

The rule on cookies in France is article 82 of the French data protection act, which transposes the EU ePrivacy directive. The CNIL guidelines of September 17, 2020, deliberation 2020-091, say in paragraph 50 that trackers whose purpose is limited to audience measurement are strictly necessary, and so not subject to prior consent. Paragraph 51 sets the conditions, and there are four of them. The trackers must have a purpose strictly limited to audience measurement of the site or app, for the publisher alone. They must not allow global tracking of the person across different apps or websites. They must only produce anonymous statistical data. And they must not lead to data being cross-referenced with other processing, or passed to third parties. Paragraph 52 adds the reminder people miss: audience measurement is still processing of personal data, and the whole GDPR still applies. The exemption only lifts the consent requirement of article 82. It does not lift anything else.

On July 4, 2025, the CNIL published updated guidance and a self-assessment grid that vendors use to certify their tools against the exemption. The grid names the only three kinds of events a consent exempt tool may collect: the mere presence of a person on a page and the information tied to that page, the use of a feature such as a button click or link click with the destination and label, and loading time, scroll, or time on page statistics. The same grid says the tool must switch off by default anything with a marketing goal, including the measurement of conversion channel performance, advertising campaign performance, and acquisition channels. Counting clicks on a button is explicitly allowed. E-commerce conversion tracking is not. The line is the purpose plus the tool, not the click itself.

The technical checklist

Meeting the conditions takes specific technical choices. No cross-site tracking means a first-party cookie only, or fully cookieless. No third party means no external integration and no data import, and the vendor must not reuse the data for its own purposes. No UTM, CRM, or campaign identifier may be collected. The IP must be truncated, with no session replay and no cross-site fingerprinting; if the IP is used at all, city level location only, then pseudonymised by removing at least the last byte. Any fingerprint must include a site-specific and a time component. No personal data such as form contents may be captured. The CNIL even asks for figures rounded to the nearest ten. And the exemption removes the consent pop-up, not the duty to inform: a privacy page with an opt-out link is still mandatory, and visitors must be informed and offered a mechanism to object. Matomo is the reference implementation the CNIL itself hosts configuration guidance for, and its setup is the model to compare against.

The retention figures sit alongside the conditions. The CNIL recommends a tracker lifetime of about 13 months and a data retention of 25 months at most. Those are recommendations in the consolidated version of deliberation 2020-092, not legal conditions, but a tool that ignores them will be hard to defend. The four conditions decide whether you need consent. The 13 and 25 month figures decide whether the setup looks like a serious attempt at the exemption or a banner removed for convenience.

Who is actually inside the frame

Most analytics setups fail the frame at the first condition. Google Analytics in its default configuration is not audience measurement for the publisher alone: the data goes to Google, Google reuses it, and the tool collects campaign identifiers by default. A first-party, self-hosted tool with no third party integration, no UTM collection, and aggregated reporting only is inside the frame. A vendor tool that passes data to a third party, or that the vendor reuses for its own purposes, is outside it, whatever the vendor claims. And the exemption is French guidance, not EU law. Other countries have their own views, some stricter, and the EU rules are under review, so a tool that is fine in France is not automatically fine elsewhere. Before you remove the banner, run the self-assessment grid honestly, and read the answer it gives you. If the answer is no, the banner stays, and the cost of the banner is the price of the analytics you actually want.

Keep reading: Consent for Analytics on the Thank-You Page: The Purchase Event That Fires Before the Choice, Embedded Maps Load Before the Choice: The Consent Leak in Every Footer, Consent Mode Signals: What Late Banner Firing Does to Your Data.

Frequently asked questions

Can analytics run without a cookie banner in France?

Yes, under the CNIL audience measurement exemption, if the tool stays inside a strict frame. The purpose must be limited to audience measurement for the publisher alone, the data must be anonymous statistics only, there must be no cross-site tracking, and the data must never be crossed with other processing or passed to third parties. The CNIL published updated guidance and a self-assessment grid on July 4, 2025.

What events can a consent exempt analytics tool collect?

At most three types: the mere presence of a person on a page and the information tied to that page, the use of a feature such as a button or link click with its destination and label, and loading time, scroll, or time on page statistics. Anything with a marketing purpose is switched off by default, including measuring conversion channel performance, advertising campaign performance, and acquisition channels.

Does the exemption cover e-commerce conversion tracking?

No. Counting clicks on a button is explicitly allowed. E-commerce conversion tracking is not. The line is the purpose plus the tool, not the click itself. A purchase event tied to a campaign, a channel, or a product is marketing measurement, and it needs consent.

How long can exempt analytics data be kept?

The CNIL recommends a tracker lifetime of about 13 months and a data retention of 25 months at most. Those figures are recommendations, not legal conditions, but a tool that ignores them will be hard to defend. The four conditions decide whether consent is needed. The retention figures decide whether the setup looks serious.