Two rules that apply together
A French site that targets visitors in France must follow the RGPD, which is the French name for the GDPR, and the cookie rules enforced by the CNIL, the national data protection authority. The CNIL’s guidance is more specific than the general law and is the one inspectors actually apply.
Cookie consent that passes
- Refusing must be as easy as accepting: a clear “Tout refuser” button next to “Tout accepter”
- No tracking cookies before consent, beyond the audience measurement the CNIL exempts
- Consent is remembered for a limited time and can be withdrawn at any moment
- Cookie walls that block access unless you accept are generally not allowed
- Every purpose and partner is listed in plain French
Mentions légales and privacy policy
French law requires identifying the publisher and the host of the site. Companies display the legal form, capital, SIREN or SIRET number, registered address and a contact. The privacy policy then explains what data is collected, why, on what legal basis, for how long and who receives it.
People’s rights
Visitors can ask for access, correction, deletion and portability of their data, and you generally have one month to reply. Build a simple form and an internal routine for this before the first request arrives, not after.
Practical checklist
- Audit every script and tag the site loads
- Choose analytics that can run with a CNIL-exempt configuration
- Host personal data in the EU and document it
- Keep a register of processing activities
- Name a contact for data questions, and a DPO when the law requires one