CNIL is France's data protection authority and has its own specific guidelines that go beyond general GDPR. For example, CNIL requires consent validity of maximum 13 months, explicitly bans cookie walls, mandates French-language privacy notices, and has specific rules about consent symmetry (reject must be as easy as accept). CNIL is also the most active EU DPA in terms of cookie enforcement.

CNIL has been the most aggressive EU DPA on cookie compliance: €150M fine against Google (2022), €60M against Facebook (2022), €40M against Criteo (2023), €32M against Amazon (2020), and €5M against TikTok (2023). They've fined over €350M just for cookie violations.

Since 2020, CNIL prohibits "cookie walls" — banners that block all content unless the user clicks "Accept All". Users must be able to continue browsing without accepting non-essential cookies. The only exception is if the site offers a genuine alternative (e.g., a paid ad-free version).

CNIL requires that cookie consent expires after a maximum of 13 months. After this period, consent must be re-obtained. Sites that store consent indefinitely or for unreasonably long periods violate this CNIL-specific requirement.

The full report includes 12 CNIL-specific checks: cookie wall detection, consent mechanism audit, pre-deposit cookie test, consent duration check, French language audit, privacy policy depth analysis, purpose limitation audit, third-party consent test, data transfer audit, enforcement risk calculation, compliance scorecard, and an AI-generated remediation plan. Price: €129.