Cnil Cookie Banner

CNIL-Compliant Cookie Banner Implementation

Overview

The Commission Nationale de l'Informatique et des Libertés (CNIL) enforces some of the strictest cookie consent requirements in the EU. Following its updated guidelines (Deliberation No. 2020-091 of 17 September 2020) and landmark enforcement actions — including the EUR 100 million fine against Google LLC and EUR 50 million against Google Ireland Limited (31 December 2021), and the EUR 60 million fine against Meta Platforms Ireland Limited (31 December 2022, later increased in subsequent actions totaling EUR 150 million across multiple decisions) — organizations serving French users must implement cookie banners meeting specific design and functional requirements.

CNIL Cookie Banner Requirements

1. Equal Prominence for Accept and Reject

The CNIL requires that the mechanism to refuse cookies must be as easy to use as the mechanism to accept them. This was the central issue in the Google and Meta enforcement actions — both companies provided a prominent "Accept All" button but required multiple clicks to reject cookies.

Compliant Design for Pinnacle E-Commerce Ltd:

Copy code
+------------------------------------------------------------------+
|  Pinnacle E-Commerce uses cookies                                |
|                                                                  |
|  We use cookies to improve your shopping experience, analyse     |
|  site traffic, and personalise content. You can accept all       |
|  cookies, reject non-essential cookies, or customise your        |
|  choices.                                                        |
|                                                                  |
|  [Accept All]    [Reject All]    [Customise]                     |
|                                                                  |
|  Privacy Policy  |  Cookie Policy                                |
+------------------------------------------------------------------+

Design Rules:

• "Accept All" and "Reject All" buttons must have identical visual weight: same size, same font, same color scheme, same position hierarchy
• Neither button may use dark patterns (e.g., bright color for accept, grey for reject)
• A "Customise" or "Manage Preferences" option must also be available at the same level
• The banner must not use manipulative language ("Accept for the best experience" vs. neutral "Reject All")

2. No Cookie Walls

Under CNIL guidelines, access to the website must not be conditioned on accepting cookies. Cookie walls — where content is blocked until the user accepts all cookies — are prohibited.

Prohibited Implementation:

Copy code
+------------------------------------------------------------------+
|  To access Pinnacle E-Commerce, please accept our cookies.       |
|                                                                  |
|  [Accept All Cookies]                                            |
+------------------------------------------------------------------+

Compliant Alternative: The site must be fully functional (at minimum, browsable) when the user clicks "Reject All." Essential cookies for cart functionality, authentication, and security may still be set under the strictly necessary exemption.

3. Granular Purpose-Level Consent

The customisation layer must allow users to consent to each purpose individually:

Layer 2 — Customise Preferences:

Copy code
+------------------------------------------------------------------+
|  Manage your cookie preferences                                  |
|                                                                  |
|  Strictly Necessary          [Always Active]                     |
|  Required for the site to function (cart, security, login).      |
|  These cannot be disabled.                                       |
|                                                                  |
|  Analytics                   [Toggle OFF]                        |
|  Help us understand how visitors use the site to improve our     |
|  services. Data is aggregated and anonymised.                    |
|  Partners: Google Analytics                                      |
|                                                                  |
|  Advertising                 [Toggle OFF]                        |
|  Used to show you relevant advertisements on other websites.     |
|  Partners: Meta, Google Ads                                      |
|                                                                  |
|  Functionality               [Toggle OFF]                        |
|  Remember your preferences such as language and currency.        |
|                                                                  |
|  [Confirm My Choices]    [Accept All]    [Reject All]            |
+------------------------------------------------------------------+

Rules for Layer 2:

• All non-essential toggles default to OFF (no pre-ticked consent)
• Each category lists specific third-party partners by name
• "Confirm My Choices" saves the current toggle state
• "Accept All" and "Reject All" remain available at this level too

4. Consent Validity and Reconsent

CNIL recommends that consent be renewed at regular intervals:

Implementation for Pinnacle E-Commerce Ltd:

Store the consent timestamp in a first-party cookie:

Copy code
cookie_consent_timestamp=2026-01-15T10:30:00Z
cookie_consent_version=v2.3
cookie_consent_state=accepted_analytics|rejected_advertising|accepted_functionality

On each page load, check:

1. Does cookie_consent_timestamp exist?
2. Is it less than 6 months old?
3. Does cookie_consent_version match the current cookie policy version?

If any check fails, redisplay the banner.

5. No Deceptive Design Patterns

CNIL specifically prohibits the following dark patterns:

Technical Implementation

Banner Loading Behavior

1. No cookies before consent: Non-essential cookies must not be set before the user interacts with the banner. Tags must be blocked at the container level.
2. Synchronous banner load: The consent banner must load before any tag management scripts execute.
3. Server-side enforcement: Consent state should be validated server-side for requests that trigger cookie setting.

Tag Blocking Architecture

Copy code
Page Load
    │
    ├── Load consent banner script (synchronous)
    │
    ├── Check consent state cookie
    │   ├── No consent recorded → Show banner, block all non-essential tags
    │   ├── Consent expired (>6 months) → Show banner, block all non-essential tags
    │   ├── Consent recorded → Parse consent state
    │       ├── Analytics accepted → Fire GA4 tags
    │       ├── Advertising accepted → Fire Meta Pixel, Google Ads tags
    │       └── Functionality accepted → Fire preference cookies
    │
    └── User interacts with banner
        ├── Accept All → Set all tags, store consent
        ├── Reject All → Block all non-essential tags, store refusal
        └── Customise → Show Layer 2, await per-purpose selection

Consent Storage

Store consent proof with the following minimum fields:

Accessibility Requirements

The cookie banner must meet WCAG 2.1 Level AA:

• Keyboard navigable (Tab, Enter, Escape)
• Screen reader compatible (ARIA roles, labels)
• Sufficient color contrast (4.5:1 ratio minimum)
• Focus trap within banner until interaction (preventing interaction with page behind)
• Banner text at minimum 14px font size

CNIL Enforcement Precedents

Key Legal References

• CNIL Deliberation No. 2020-091 (17 September 2020) — Guidelines on cookies and other trackers
• CNIL Recommendation on cookies (1 October 2020) — Practical modalities for consent collection
• ePrivacy Directive 2002/58/EC, Article 5(3) — Consent for storing/accessing information on devices
• CJEU Case C-673/17 (Planet49) — Active consent, no pre-ticked boxes
• GDPR Article 7 — Conditions for consent, including withdrawal
• CNIL Decision SAN-2021-023 (Google) — EUR 150M total fine for cookie consent violations
• CNIL Decision SAN-2022-021 (Meta) — EUR 60M fine for cookie consent violations