# Audience measurement without a consent banner: what the CNIL allows > The CNIL allows a consent exemption for some audience measurement tools, but only if their purpose, configuration and retention periods meet precise criteria. GA4, in its standard configuration, doesn’t meet these criteria and therefore, in principle, requires consent like any other non-exempt tracker. - Source canonique : [https://allaux.fr/en/services/tracking/mesure-audience-sans-consentement-cnil](https://allaux.fr/en/services/tracking/mesure-audience-sans-consentement-cnil) - Langue : EN - Dernière mise à jour : 2026-09-30 ## Direct answer > The consent exemption set out by the CNIL only applies where the tool measures audience for the site publisher alone, produces anonymous statistics that are not cross-referenced with other processing, and gives visitors a straightforward way to object. GA4 in its standard configuration does not meet those conditions. Check your tool’s actual purpose and retention periods before removing a banner. ## What I see most often - Wanting to avoid a consent banner on the assumption that "audience measurement is exempt anyway" - GA4 already installed on the assumption it naturally falls within the CNIL exemption - Confusion with the CNIL’s old list of evaluated tools, which no longer works the same way today - An alternative tool marketed as "GDPR-compliant without consent" without checking whether its actual configuration meets the criteria - Fear of having to choose between a systematic consent banner and reliable audience measurement ## The criteria I check before discussing exemption 1. **Purpose strictly limited to audience measurement** — The tool must be used exclusively to measure the site’s audience, for the sole benefit of that site’s publisher, with no other use or sharing with a third party. 2. **Anonymous statistics, no cross-referencing** — Data must be used only to produce anonymous statistics, never cross-referenced with other processing (advertising, CRM, another site). 3. **Clear information and easy opt-out** — Visitors must be clearly informed about this measurement and have a simple, accessible way to opt out, not buried inside an unreadable privacy policy. 4. **Limited retention periods** — The CNIL sets two distinct ceilings: 13 months' lifespan for the tracker itself, with no automatic renewal on each new visit, and 25 months' retention for the data collected through it. Beyond that, the exemption no longer holds. 5. **The exact configuration recommended by the tool’s publisher** — Since the evaluation programme the CNIL announced on 4 July 2025, it no longer pre-validates a list of tools itself: it published a self-assessment grid that publishers can use to declare their solution compliant, under their own responsibility. Following their recommended configuration to the letter is essential: an exemptable tool that’s misconfigured loses the benefit of the exemption. ## The GA4 case, stated precisely Google Analytics (Universal Analytics before, GA4 today) has never featured in the CNIL’s evaluation programme and isn’t presented by it as a tool eligible for the exemption, notably because of data transfers to the United States. That doesn’t mean GA4 is generally "banned" under French law: it means GA4, in its standard configuration, doesn’t meet the CNIL’s exemption criteria and therefore, in principle, requires prior consent, exactly like any other non-exempt tracker. Audience measurement solutions exist that can be configured to meet these criteria, under the responsibility of their publisher, who must be able to demonstrate it. I stay deliberately factual on this point without recommending a specific brand: what matters is checking the configuration actually applied, not the tool’s marketing claim. ## It’s up to the site’s publisher to demonstrate it > Since that same July 2025 programme, the CNIL no longer pre-validates a list of exempt tools: it’s up to the site’s publisher to be able to demonstrate, if checked, that the tool used and its configuration meet the exemption criteria. A default configuration, never checked, isn’t enough to demonstrate that. ## Related pages - **Google Consent Mode** — Google’s technical requirement for Google Ads in Europe, distinct from the legal obligation to collect consent. ([/services/tracking/mode-consentement-europe](/services/tracking/mode-consentement-europe)) - **A gap between real orders and measured conversions** — Consent refusal is one of the structural causes of the gap, distinct from a technical bug. ([/services/tracking/ecart-commandes-boutique-outil-mesure](/services/tracking/ecart-commandes-boutique-outil-mesure)) - **Privacy policy** — This site’s page describing what’s done with visitor data. ([/confidentialite](/confidentialite)) - **Cookie policy** — The detail of the trackers this site places, and how to manage your choice. ([/cookies](/cookies)) ## FAQ ### Is GA4 banned in France? No, that’s not what the CNIL says. GA4, in its standard configuration, simply doesn’t meet the consent exemption criteria it has set for audience measurement, and therefore requires prior consent in principle, like any other non-exempt tracker. ### What exactly are the CNIL’s exemption criteria? A purpose strictly limited to audience measurement for the sole benefit of the site’s publisher, data used only for anonymous statistics with no cross-referencing, clear visitor information, a simple opt-out mechanism, and limited durations (13 months' lifespan for the tracker, 25 months' retention for the data collected through it, per CNIL documentation). ### What changed in 2025? In its news item of 4 July 2025, the CNIL announced it no longer pre-validates a list of exempt tools itself. It published a self-assessment grid that audience measurement publishers can use to declare their tool compliant, under their own responsibility, with the site’s publisher having to be able to demonstrate it if checked. ### Is an "exemptable" tool automatically exempt regardless of configuration? No. A tool that can technically meet the exemption criteria loses that benefit if it’s misconfigured, for example if the retention period exceeds recommended thresholds or data is cross-referenced with another process. ### If my measurement tool isn’t exempt, do I need a consent banner? Yes, in principle, prior consent is then required just like for any non-exempt tracker, regardless of which tool is chosen.