Available for projects & agency overflow · Quick reply, from the person who does the work

Send a message contact@allaux.fr
FR EN TR
allaux.
Emergency Discuss my project

Audience measurement without a consent banner: what the CNIL allows

The CNIL allows a consent exemption for some audience measurement tools, but only if their purpose, configuration and retention periods meet precise criteria. GA4, in its standard configuration, doesn’t meet these criteria and therefore, in principle, requires consent like any other non-exempt tracker.

Describe my issue Send a message

What I see most often

  • Wanting to avoid a consent banner on the assumption that "audience measurement is exempt anyway"
  • GA4 already installed on the assumption it naturally falls within the CNIL exemption
  • Confusion with the CNIL’s old list of evaluated tools, which no longer works the same way today
  • An alternative tool marketed as "GDPR-compliant without consent" without checking whether its actual configuration meets the criteria
  • Fear of having to choose between a systematic consent banner and reliable audience measurement

The criteria I check before discussing exemption

  1. Purpose strictly limited to audience measurement

    The tool must be used exclusively to measure the site’s audience, for the sole benefit of that site’s publisher, with no other use or sharing with a third party.

  2. Anonymous statistics, no cross-referencing

    Data must be used only to produce anonymous statistics, never cross-referenced with other processing (advertising, CRM, another site).

  3. Clear information and easy opt-out

    Visitors must be clearly informed about this measurement and have a simple, accessible way to opt out, not buried inside an unreadable privacy policy.

  4. Limited retention periods

    The CNIL sets two distinct ceilings: 13 months' lifespan for the tracker itself, with no automatic renewal on each new visit, and 25 months' retention for the data collected through it. Beyond that, the exemption no longer holds.

  5. The exact configuration recommended by the tool’s publisher

    Since the evaluation programme the CNIL announced on 4 July 2025, it no longer pre-validates a list of tools itself: it published a self-assessment grid that publishers can use to declare their solution compliant, under their own responsibility. Following their recommended configuration to the letter is essential: an exemptable tool that’s misconfigured loses the benefit of the exemption.

The GA4 case, stated precisely

Google Analytics (Universal Analytics before, GA4 today) has never featured in the CNIL’s evaluation programme and isn’t presented by it as a tool eligible for the exemption, notably because of data transfers to the United States. That doesn’t mean GA4 is generally "banned" under French law: it means GA4, in its standard configuration, doesn’t meet the CNIL’s exemption criteria and therefore, in principle, requires prior consent, exactly like any other non-exempt tracker.

Audience measurement solutions exist that can be configured to meet these criteria, under the responsibility of their publisher, who must be able to demonstrate it. I stay deliberately factual on this point without recommending a specific brand: what matters is checking the configuration actually applied, not the tool’s marketing claim.

Related pages

Describe your need in one minute

A few targeted questions so I can reply with an estimate rather than another questionnaire.

besoin
plateforme
echeance
budget (facultatif)
Please provide an email or a phone number so I can get back to you.

Please provide an email or a phone number so I can get back to you.

Frequently asked questions

Is GA4 banned in France?
No, that’s not what the CNIL says. GA4, in its standard configuration, simply doesn’t meet the consent exemption criteria it has set for audience measurement, and therefore requires prior consent in principle, like any other non-exempt tracker.
What exactly are the CNIL’s exemption criteria?
A purpose strictly limited to audience measurement for the sole benefit of the site’s publisher, data used only for anonymous statistics with no cross-referencing, clear visitor information, a simple opt-out mechanism, and limited durations (13 months' lifespan for the tracker, 25 months' retention for the data collected through it, per CNIL documentation).
What changed in 2025?
In its news item of 4 July 2025, the CNIL announced it no longer pre-validates a list of exempt tools itself. It published a self-assessment grid that audience measurement publishers can use to declare their tool compliant, under their own responsibility, with the site’s publisher having to be able to demonstrate it if checked.
Is an "exemptable" tool automatically exempt regardless of configuration?
No. A tool that can technically meet the exemption criteria loses that benefit if it’s misconfigured, for example if the retention period exceeds recommended thresholds or data is cross-referenced with another process.
If my measurement tool isn’t exempt, do I need a consent banner?
Yes, in principle, prior consent is then required just like for any non-exempt tracker, regardless of which tool is chosen.

Related pages