In short
- The consent exemption exists, but it is narrow. It covers only audience measurement strictly necessary to the operation of the site, carried out for the publisher alone, with no cross-referencing and no transmission to third parties.
- Google Analytics 4 does not qualify in its standard configuration. The data collected also serves Google, which is enough for the exemption to fall. Prior consent is therefore required.
- Server-side tracking does not remove the need for consent. It moves where the data travels, not the legal nature of the processing. It is the most expensive mistake we come across in audits.
- The immediate risk is not the fine, it is the formal notice. It arrives with a short deadline, it ties up your teams, and it can be made public.
We open a site in a private window. We click “Reject”. Then we look at the browser’s network tab: in a majority of the audits we run, requests leave anyway, towards a measurement tool or an advertising network.
In almost every case, nobody cheated. The marketing team installed a consent management platform, ticked what seemed reasonable, and considered the subject closed. The problem comes from a misunderstanding about a single word: “exemption”.
Many company directors took away from 2021 that the CNIL, the French data protection authority, allowed audience measurement without consent. That is true, but on conditions so precise that most real configurations do not meet them. That gap between what people believe is allowed and what actually is has become the leading cause of non-compliance we see on the sites of smaller and mid-sized companies.
The text that applies is not the one you think
When cookies come up, the reflex is to cite the GDPR. The text that governs writing to and reading from a user’s device is in fact Article 82 of the French Data Protection Act, the French transposition of the ePrivacy Directive.
That distinction is not a lawyer’s detail. Article 82 is triggered as soon as information is written to or read from the user’s device, whether or not that information is personal data. An anonymous technical identifier stored in the browser falls under Article 82, even if it identifies nobody.
The default rule is simple: prior consent, freely given, specific, informed and unambiguous. The exemption is the exception. In its guidelines and its cookie recommendation, adopted in 2020, the CNIL set out what those exceptions cover and how to collect valid consent. Clear consent that can genuinely be withdrawn remains the foundation of everything else.
Only two categories escape consent: trackers strictly necessary to provide the service the user expressly asked for (basket, session, language preference, security) and those whose sole purpose is to enable or facilitate electronic communication. Audience measurement is exempt only if it is configured so as to become strictly necessary to the operation of the site.
The six concrete conditions of the exemption
The exemption does not attach to a piece of software, it attaches to a configuration. The same tool can be exempt in one setup and subject to consent in another. Here are the conditions to meet at the same time.
- A strictly limited purpose. Measuring site performance, detecting navigation problems, ergonomics, content popularity, server sizing. No ad targeting, no personalisation, no commercial scoring.
- For the publisher alone. The vendor acts as a processor and uses the data for no purpose of its own. This is the most frequent breaking point.
- No cross-referencing. The data is not combined with any other processing, any customer file, any third-party database.
- No cross-site tracking and no transmission. The tracker does not follow browsing from one site to another, and the data is not passed to third parties. The IP address must be truncated and geolocation must not go below city level.
- Bounded retention. The CNIL works with an order of magnitude of thirteen months for the life of the tracker and twenty-five months for the data collected, with no automatic extension on each visit, and with periodic review.
- Information and a right to object. The exemption removes the need for consent, never the need to inform people or to offer a simple way to opt out of the measurement.
Some A/B tests aimed at improving ergonomics can fall within the same scope, if they do not substantially change the service and stay limited in time. The line is crossed as soon as a test result is used to personalise the experience of an identified individual.
A word about lists of so-called “approved” solutions. The CNIL publishes and updates configuration guides for exempt mode for specific versions of certain tools. A list copied into an article goes stale quickly: the reference to consult is the CNIL’s own page, on the date you configure your tool.
The Google Analytics 4 case
It is the question that comes up in every meeting: “is GA4 legal?”. The answer has two parts.
First: in its standard configuration, GA4 does not meet the conditions of the exemption. The data feeds Google’s ecosystem, serves advertising signals, modelling and audiences, and Google does not limit itself to the role of a processor acting for the publisher alone. Both the “publisher alone” condition and the “no transmission to third parties” condition fall.
Second: that does not make GA4 illegal, it makes it subject to consent. You can use it perfectly well, provided no request leaves before explicit consent, and provided a refusal is honoured in practice. Our audits show that the second point fails far more often than the first.
The question of transfers outside the European Union was added to this file from 2022, with a series of formal notices sent by the CNIL to publishers using Google Analytics. The adoption of the EU-US adequacy framework in July 2023 eased that particular point, without erasing the consent question, which remains whole. If you are weighing up what GA4 actually gives your company, the consent question belongs in that decision from the start.
What to take away The split between exempt and subject to consent does not depend on the software but on its configuration and on what the vendor does with the data. The useful question is therefore not “is this tool legal” but “who exploits my data, and for what purpose”.
Consent Mode: what it settles, what it does not
Google’s Consent Mode is a mechanism that passes the user’s consent state to the tags, through parameters such as analytics storage, ad storage, ad user data and personalisation. Since March 2024, Google requires version 2 of it to keep feeding audiences and conversions in the European Economic Area.
What Consent Mode settles: the technical consistency between your banner and your tags. Without it, a refusal often stays declarative and the tags keep firing.
What it does not settle: the legal validity of how you collect consent. Consent Mode obeys the information your consent platform sends it. If that signal is wired wrong, or if your banner does not offer a refusal as simple as acceptance, Consent Mode will faithfully transmit invalid consent.
One point deserves your attention. So-called advanced mode sends requests to Google before consent, in principle without a cookie and without an identifier, to allow statistical modelling of the missing conversions. That behaviour is not legally neutral: everything depends on what those requests actually carry, IP address included. It is not a choice to make by default in an interface.
Server-side does not remove consent
The mistake not to make Believing that moving to server-side removes the banner. That sentence is put to us as a solution several times a quarter. It exposes the company to a breach across all of its trackers, with a technical setup rebuilt for nothing.
| Point | Effect of moving to server-side |
|---|---|
| Consent obligation | No change. The trigger is still writing to or reading from the device. |
| Cookie set by your own server | Still a cookie, still covered by Article 82, whatever the domain that sets it. |
| Personal data processed without a tracker | Still covered by the GDPR, with a legal basis to justify. |
| Reliability of the measurement | Restored against blockers and against the limits browsers place on cookie lifetime. |
| Control of outgoing flows | You decide which field goes to which platform, what you filter, what you log. |
| Demonstrating compliance | Simpler, because everything passes through a single point you control. |
We set out this gap between what the tools show and what actually happens in our article on tracking that lies in silence.
In other words, server-side is an instrument for data quality and control, not a way around consent. It is on that principle that Datafirefly Limited, a publisher in the same group as our agency, built its server-side tracking platform, whose operation stays conditioned on the consent signal the site sends it.
What a company actually risks
The typical scenario does not start with a fine.
| Stage | What triggers it | What happens | Outcome |
|---|---|---|---|
| Inspection | A user complaint, a report from an association, a themed campaign announced by the CNIL | Loading the site and observing the requests before and after a refusal, often without any visit | Case closed, or formal notice |
| Formal notice | A breach established | A decision by the CNIL’s president, with a deadline to comply. It is not a sanction but a formal warning | Procedure closed if you comply within the deadline, usually without publicity |
| Sanctions panel | Deadline missed | The file is examined by the sanctions body | Reprimand, injunction with a daily penalty, restriction of processing, or a fine |
| Administrative fine | A characterised and continuing breach | Ceilings expressed as a percentage of worldwide annual turnover | A simplified procedure is possible for low-complexity breaches, with markedly smaller amounts |
For a smaller company, the real cost rarely sits in the amount. It sits in the time your teams spend under a tight deadline, in rebuilding a tagging plan that has accumulated over five years, and in the possible publicity of the decision. It is a matter of governance and digital transformation as much as a legal one.
Your compliance plan in six steps
Here is what you can start this week, with no budget, before calling anyone.
- Test before you believe. Open your site in a private window, refuse everything, then inspect the network tab and the browser’s local storage. Note every outgoing request and every tracker set despite the refusal.
- Sort each tracker into three piles. Strictly necessary, audience measurement potentially exemptable, subject to consent. Anything touching advertising, retargeting or personalisation goes in the third pile, no discussion.
- Check the banner is symmetrical. Refusing must take the same number of clicks as accepting, and the choice must be changeable at any time from an accessible page.
- Document. An up-to-date processing register, written retention periods, recipients listed, timestamped proof of consent kept. Without documentation, a correct configuration stays impossible to demonstrate.
- Plan a fallback measurement. Configure a tool in exempt mode to keep a view of traffic when consent is refused, rather than flying blind. That is the substance of our work on data reliability and performance.
- Repeat the test every quarter. Every new tag, every theme change, every plugin installed can reintroduce a tracker without consent. Compliance is not a state, it is a routine.
Frequently asked questions
Can I use Google Analytics without a cookie banner?
No, not in its standard configuration. Google Analytics 4 does not meet the conditions of the consent exemption, in particular because the data is not processed for the publisher alone. You therefore have to collect prior consent and make sure no request leaves before that consent.
What is the difference between a consent exemption and having no GDPR obligation?
They are two separate things. The exemption bears only on the obligation to collect consent before setting a tracker, under Article 82 of the French Data Protection Act. You remain covered by the GDPR for everything else: informing people, retention periods, the processing register, rights of access and objection, security.
Does server-side tracking let me do without consent?
No. Server-side changes the technical path of the data, not the legal qualification of the processing. As soon as information is written to or read from the user’s device, consent is still required, whether the cookie is set by a third-party script or by your own server. Server-side improves the reliability of your measurement and your control over the flows, which is already reason enough to adopt it.
How long can I keep my audience measurement data?
Within the exemption, the CNIL works with periods in the order of thirteen months for the life of the tracker and twenty-five months for the data collected, with no automatic renewal on each visit. Those periods must be reviewed regularly and justified by your real need. Outside the exemption, you set a period proportionate to your purpose and you document it.
What happens if the CNIL inspects my site?
An online inspection often consists in loading your site and observing what fires before and after a refusal. If a breach is found, the authority can send a formal notice with a deadline to comply. Complying within that deadline usually closes the procedure, without a sanction and most often without publicity.
Measure less, but measure right
The defensive reflex is to collect everything and hope nobody looks. The effective reflex is to decide what you genuinely need to know in order to steer, then build a collection that stands up legally and technically. A well-configured exempt measurement, paired with a richer consented one, is almost always more usable than a pile of tags.
The gradual disappearance of third-party cookies pushes in that direction anyway, and the companies that anticipated the shift do not suffer the regulatory constraint, they use it to clean up their setup. We covered that shift from the opportunity angle in our article on the end of third-party cookies.
Unsure whether your audience measurement is compliant? We always start with the same move: open your site in a private window, refuse cookies, and list what leaves anyway. Let’s talk.