Can you run web analytics without a cookie banner in France? The CNIL says yes — if your tool passes this test
Yes — in France you can measure your site's traffic without a cookie consent banner, but only if the tool you use meets a specific list of conditions set by the CNIL, the French data-protection regulator. If it does, you switch from opt-in (a banner the visitor has to accept) to opt-out (you inform people and let them object). If it doesn't, you need consent like any other tracker.
What changed in 2026: since 1 January 2026, the CNIL no longer publishes a list of pre-approved "exempt" tools. It offers a self-assessment framework instead, so the publisher and provider must check the deployment against the criteria and keep evidence.
This post is the test, in plain terms, plus a look at which kinds of tools clear it and which don't.
What the CNIL exemption actually is (and isn't)
First, scope. This is an exemption from the consent requirement in Article 82 of the French Data Protection Act — the rule that implements the ePrivacy "cookie" directive. It is not an exemption from the GDPR. If your analytics still processes personal data, the GDPR's other obligations (lawful basis, information, data-subject rights) continue to apply. The exemption only means you don't need to collect prior consent — no banner blocking the page — for that specific measurement.
Second, it's national. The CNIL has been one of the more permissive regulators in Europe on this, and others are now moving toward it rather than away: the UK opened its own first-party analytics exemption in February 2026 under the Data (Use and Access) Act, on a similar inform-and-opt-out basis. But it still isn't uniform — several German authorities continue to require opt-in consent for analytics cookies. So "no banner for analytics" depends on where your visitors are; France has been ahead of the curve rather than alone on it. (What might eventually harmonise the rules across the whole EU is the Digital Omnibus proposal working its way through Brussels — but that's still a proposal in negotiation, not law. France's regime is the one that's actually in effect today.)
The test: what a tool must satisfy
The CNIL's guidance (its "Sheet no. 16" on analytics, and the "cookies and other trackers" recommendation) lays out cumulative conditions. All of them have to hold — miss one and you're back to needing consent.
| CNIL condition | What it means in practice |
|---|---|
| Sole purpose: audience measurement | The tracker is used only to produce traffic statistics for the site (A/B testing is allowed). Not advertising, not retargeting, not building user profiles. |
| Single publisher, first-party | The scope is limited to one site or app editor. No pooling of the same identifier across different sites to follow a person around the web. |
| No cross-checking | The data isn't matched against other processing — customer databases, visit stats from other sites, and so on. |
| No third-party data sharing | Non-anonymised data isn't handed to third parties. |
| Truncated IP | The last byte of the IP address is dropped, reducing precision; truncation alone does not guarantee anonymity. |
| Short lifetime | Trackers and any identifier live no more than 13 months, not silently renewed on every visit. |
| Anonymous output | The result is aggregate, anonymous statistics — not a re-identifiable record of individuals. |
There's one more condition people forget because it isn't technical, and it stays on you no matter how clean your tool is: even for an exempt tool, you must still inform visitors that measurement is happening and give them an easy way to object. Opt-out isn't "no obligations" — it's "no consent wall, but transparency and a working opt-out." Any tool or agency that tells you an exempt analytics setup means you can say nothing at all is wrong.
Why GA4's standard setup is difficult to exempt
The CNIL warns that many large audience-measurement offerings fall outside the exemption even when configured carefully. GA4's standard cookies and, when linked to Google Ads, its advertising purposes make its setup hard to fit within publisher-only audience measurement. Assess your actual configuration against the criteria rather than assuming a product name is approved or banned; the Simplytics vs Google Analytics comparison covers their technical differences.
What clears the test
The CNIL points to self-hosted Matomo, correctly configured, as one possible option. Other first-party tools may also qualify, but being cookieless is only one part of the test. The conditions include genuinely anonymous statistics, publisher-only use, visitor information and a way to object.
What Simplytics brings to that test:
- No visitor cookies or browser storage. The script sets nothing on the visitor's device.
- Truncated IP for counting. The connecting IP is truncated before it and the user-agent are used to make a keyed daily hash. The raw IP is not stored in the analytics database, but the hash is temporarily stored and can link same-day visits on one site. The visitor's country comes from Cloudflare's
CF-IPCountrycode. - No shared cross-site identifier. The domain is part of the hash, so it is not reused across websites.
- Short-lived raw rows, retained aggregates. Raw visit rows are deleted nightly, within 48 hours. Daily counts remain, but a page path, event name or campaign value can itself identify someone if a site sends it.
The publisher still has to inform visitors and offer a way to object. Simplytics' opt-out page explains its Global Privacy Control behavior, including the site-owner override; check whether that behavior and your own notice meet the French conditions.
Simplytics costs $1/month billed yearly, with its primary database in Warsaw.
So, can you drop the banner?
If your site serves French visitors and you want to measure traffic without a consent banner, the workable path in 2026 is:
- Pick and configure a tool that meets the CNIL criteria. Cookieless design helps but is not proof.
- Do the self-assessment and keep the record. With no public list since January 2026, you and your provider should document how the deployment meets each criterion and keep that evidence for a CNIL check.
- Still inform and still offer opt-out. No banner blocking the page, but a clear privacy notice and a working objection mechanism.
The practical answer: France permits the exemption only when every condition is met. Simplytics' daily hash and text dimensions belong in your self-assessment. CNIL's current guidance sets out the conditions.