FRANCE Law and Practice Contributed by: Marianne Le Moullec, Gaëlle Robic and Joséphine Perrin, Orasis Avocats
Among significant decisions, the CNIL issued a sanc - tion decision and a EUR525,000 fine on 4 April 2024 against a company that had sent more than 1.4 million text messages (as well as emails) to consumers who had not given positive informed consent to commer - cial prospection via SMS. On 15 May 2025, the CNIL issued a sanction decision and a EUR900,000 fine against the “SoLocaL” company, which had sent more than 4.7 million text messages (as well as emails) to consumers who had not given positive informed con - sent to commercial prospection via SMS. 6.4 Targeted/Interest-Based Advertising Targeted advertising is delivered by placing cookies on the user’s terminal to learn about their browsing habits. Article 82 of the French Data Protection Act, transposing Article 5.3 of the European Directive on ePrivacy, governs the rules concerning the placement of cookies for targeted advertising. Any cookie placement on a user’s terminal requires the prior positive informed consent of the consumer, unless it is for the sole purpose of carrying out a com - munication over an electronic online network, or is strictly necessary in order to provide a service explic - itly requested by the consumer. Consent for targeted advertising must meet the GDPR’s strict requirements. The validity of such consent may be affected by how it is obtained – for instance, through cookie banners or so-called “cook - ie walls”. The latter, which restrict access to content unless users accept tracking, are subject to strict scrutiny under both CNIL guidance and recent Euro - pean case law. In addition, the DSA prohibits targeted advertisement to minors on online platforms. Targeted advertisement on online platforms is also prohibited when profiling uses special categories of personal data, such as eth - nicity, political views or sexual orientation. Among significant recent decisions, the CNIL imposed a EUR325 million fine on Google on 1 September 2025 for having placed advertisements within its clients’ email boxes without consent, and for having placed cookies when the email accounts were created, again without valid consent. An injunction to stop,
within six months, has been issued, with a penalty of EUR100,000 per day being incurred in case of non- compliance. On the same date, the CNIL issued a EUR150 fine against SHEIN, a website selling fast fashion, for hav - ing placed cookies without proper consent, for not respecting the users’ choice and for not giving them proper information. 6.5 Marketing to Children Legal representatives (usually parents) are the ones who should exercise the child’s rights to consent with regards to its personal data being collected or used. However, for minors aged 16 and over, the GDPR (Arti - cle 8) and the French Act on Data Protection (Article 45) allow the minor to give its consent for some but not all data uses. The minor must be informed in a clear and appropriate manner of the conditions of use of his or her data and of his or her rights, so that he or she can understand the meaning and scope of his or her consent (Article 45). All other rules applicable to the collection and use of personal data are applicable and must be strictly followed. The DSA prohibits targeted advertisement to minors Since Law No 2025-594 of 30 June 2025 against all forms of fraud involving public assistance entered into force, commercial prospection via email, phone, auto - mated calls or social media for the sale of equipment or work related to housing energy savings, renewable energy production or the adaptation of housing for aging or disability is strictly prohibited. The use of “cookie walls” that condition access to a website or service on the user’s acceptance of tracking technologies is not in itself prohibited under French data protection law. The CNIL conducts a case-by-case analysis to determine whether users are offered a real and fair alternative, such as access without tracking or a reasonably priced paid version. The use of geolocation data for targeted marketing purposes (eg, via mobile apps, push notifications or on online platforms. 6.6 Other Rules
145 CHAMBERS.COM
Powered by FlippingBook