Can you run web analytics without a cookie banner in France? The CNIL says yes — if your tool passes this test

July 22, 2026

Yes — in France you can measure your site's traffic without a cookie consent banner, but only if the tool you use meets a specific list of conditions set by the CNIL, the French data-protection regulator. If it does, you switch from opt-in (a banner the visitor has to accept) to opt-out (you inform people and let them object). If it doesn't, you need consent like any other tracker.

The catch, and the reason this is worth a fresh look in 2026: since 1 January 2026, the CNIL no longer publishes a list of pre-approved "exempt" tools. It retired that public list and replaced it with a self-assessment framework. Nobody hands you a certificate anymore. It's now on you — the publisher — and your analytics provider to check the tool against the criteria and be able to prove it if the regulator ever asks. So the practical question has quietly changed from "is my tool on the list?" to "can my tool actually pass the test, and can I show my work?"

This post is the test, in plain terms, plus an honest look at which kinds of tools clear it and which don't.

What the CNIL exemption actually is (and isn't)

First, scope. This is an exemption from the consent requirement in Article 82 of the French Data Protection Act — the rule that implements the ePrivacy "cookie" directive. It is not an exemption from the GDPR. If your analytics still processes personal data, the GDPR's other obligations (lawful basis, information, data-subject rights) continue to apply. The exemption only means you don't need to collect prior consent — no banner blocking the page — for that specific measurement.

Second, it's national. The CNIL has been one of the more permissive regulators in Europe on this, and others are now moving toward it rather than away: the UK opened its own first-party analytics exemption in February 2026 under the Data (Use and Access) Act, on a similar inform-and-opt-out basis. But it still isn't uniform — several German authorities continue to require opt-in consent for analytics cookies. So "no banner for analytics" depends on where your visitors are; France has been ahead of the curve rather than alone on it. (What might eventually harmonise the rules across the whole EU is the Digital Omnibus proposal working its way through Brussels — but that's still a proposal in negotiation, not law. France's regime is the one that's actually in effect today.)

The test: what a tool must satisfy

The CNIL's guidance (its "Sheet no. 16" on analytics, and the "cookies and other trackers" recommendation) lays out cumulative conditions. All of them have to hold — miss one and you're back to needing consent.

There's one more condition people forget because it isn't technical, and it stays on you no matter how clean your tool is: even for an exempt tool, you must still inform visitors that measurement is happening and give them an easy way to object. Opt-out isn't "no obligations" — it's "no consent wall, but transparency and a working opt-out." Any tool or agency that tells you an exempt analytics setup means you can say nothing at all is wrong.

Why Google Analytics fails it

The CNIL is blunt on this point: "most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration." Google Analytics — Universal Analytics and GA4 alike — has never qualified. The reasons map straight onto the conditions above: data flows to Google's servers and into an advertising ecosystem, cross-checking can't be ruled out, and the processing isn't confined to a single publisher's own measurement. There's no toggle in GA4 that fixes that; the disqualification is structural. That's why, for a French site owner who wants to drop the banner, GA4 is the one mainstream tool that definitively can't get you there — see our side-by-side on Simplytics vs Google Analytics for the rest of the trade-offs.

What clears the test — and where we have to be honest

Here's where a lot of vendor blogs would claim their tool is the special one. It isn't, and pretending otherwise would undercut the whole point of a privacy-first product.

The CNIL itself points to self-hosted Matomo, correctly configured, as a tool that can meet the criteria. And the broader category that clears this test comfortably is cookieless, first-party analytics — the same design shared by Plausible, Fathom, Simple Analytics, and Simplytics. If a tool sets no advertising cookies, keeps each site's data to itself, and produces only aggregates, most of the conditions are met by design rather than by configuration. So no, you don't need us specifically to drop the banner in France. Several tools get you there.

Where the honest differentiator sits is how little you have to do to clear it, and what it costs. Simplytics meets every technical condition on that list by construction, with nothing to configure:

• No cookies at all. The 13-month tracker limit is moot when there's no tracker to expire — the script sets nothing on the device.
• IP truncated before use, then never kept. The CNIL asks you to drop the last byte of the IP; Simplytics does exactly that — the connecting IP has its last segment stripped before it's hashed into a same-day deduplication identifier — and then keeps nothing. The raw IP is never stored, and the visitor's country comes from Cloudflare's CF-IPCountry edge header (a two-letter code), not from an IP lookup. So it satisfies the truncation rule and goes past it: there's no address on file at all.
• Single publisher, no cross-site profiling. Each site's stats stand alone; there is no shared cross-site identifier.
• Aggregates only, raw records wiped nightly. The output is anonymous statistics; the underlying raw rows don't survive the night, so there's nothing re-identifiable sitting around to fail an audit.

The one condition it can't meet for you is the publisher's duty to inform visitors and honour opt-out — that's yours to put on the page, because it's a duty on the site owner, not the tool. What a cookieless tool does is make that notice trivially honest: you can tell visitors, accurately, that you set no cookies and store no personal data about them.

And the reason to mention price at all here is that this used to be the trade-off — privacy-clean analytics meant either running your own Matomo server or paying $9–15/month for a hosted privacy tool. Simplytics does the same job, clears the same French test by construction, keeps EU data in Warsaw, and runs $1/month. A lot of functionality for a lot less money, without the banner.

So, can you drop the banner?

If your site serves French visitors and you want to measure traffic without a consent banner, the workable path in 2026 is:

1. Pick a tool that meets the CNIL criteria — cookieless first-party analytics, or a properly locked-down self-hosted Matomo. Not GA4.
2. Do the self-assessment and keep the record. Since January 2026 there's no public list to point at; you (and your provider) certify against the criteria and hold documentation in case of a CNIL check. The CNIL even suggests wording along the lines of: "According to our self-assessment, solution XXX complies with the criteria established by the CNIL and can be deployed without user consent if correctly configured."
3. Still inform and still offer opt-out. No banner blocking the page, but a clear privacy notice and a working objection mechanism.

The bottom line: France lets you run analytics without a cookie consent banner, but as of 1 January 2026 you have to demonstrate your tool passes the CNIL's test yourself instead of finding it on an approved list. Cookieless, first-party analytics passes that test the way it's built — no cookies to time-limit, no IP to truncate, aggregates only — which is why a tool like Simplytics clears it with zero configuration at $1/month, while GA4 can't clear it at any price. Just remember the part the exemption never removes: you still owe your visitors a plain notice and an easy way to say no.