Loi Informatique et Libertés
TL;DR
Websites targeting users in France must comply with GDPR as implemented locally through the Loi Informatique et Libertés. The supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL). Notable enforcement: Google fined for cookie consent violations (€150 million). Use our free scanner below to check your website instantly.
Free audit — 25+ automated checks in 60 seconds
Scan My Website Free →Authority
Commission Nationale de l'Informatique et des Libertés (CNIL)
Website
www.cnil.fr ↗Local Law
Loi Informatique et Libertés
Language
French
Largest Fine
€150 million
Population
68 million
CNIL cookie guidelines require explicit consent before non-essential cookies
Refuse button must be as prominent as Accept button
Cookie walls are generally prohibited
Data Protection Officer mandatory for public bodies and large-scale processors
Privacy impact assessments required for high-risk processing
French language privacy policy required for French-facing websites
The CNIL is one of the most active DPAs in Europe, having issued major fines to Google (€150M), Amazon (€35M), and Meta (€60M). Their cookie guidelines published in 2020 are considered the gold standard for consent implementation.
Cookie consent banner that requires opt-in before non-essential cookies
Privacy policy available in French
Clear identification of data controller and contact details
Data Processing Agreement (DPA) with all third-party processors
Lawful basis documented for each processing activity
Data Subject Access Request (DSAR) process in place
Data breach notification procedure compliant with 72-hour rule
Data Protection Impact Assessment for high-risk processing
International data transfer mechanisms documented (SCCs, adequacy decisions)
Records of processing activities (ROPA) maintained
In France, websites must comply with GDPR as implemented by the Loi Informatique et Libertés. Key requirements include obtaining explicit consent before setting non-essential cookies, providing a clear privacy policy, appointing a DPO when required, and notifying data breaches within 72 hours to the Commission Nationale de l'Informatique et des Libertés (CNIL).
The Commission Nationale de l'Informatique et des Libertés (CNIL) is the supervisory authority responsible for enforcing data protection laws in France. They can investigate complaints, conduct audits, and issue fines up to €20 million or 4% of annual global turnover.
Use PrivacyChecker's free scanner to perform an instant audit of your website. Our tool checks 25+ compliance points including cookie consent, privacy policy presence, security headers, tracker detection, and more — all relevant to France's GDPR requirements.
Find out in 60 seconds with our free GDPR scanner
Run Free Audit →