Manage cookies and other trackers on a company's website

Verified 13 October 2026 - Entreprendre Service Public / (Prime Minister)

The cookies and others plotters in particular, they enable the operation of a website, the measurement of its attendance or the display of targeted advertising. The company must identify those it uses, inform Internet users and obtain their consent when necessary, for example by means of a cookie consent banner.

Step-by-step approach

When a website uses cookies and others plotters, the company must comply with certain information obligations, in particular those relating to mandatory information on the website.

For this, the company must start with identify cookies and other tracers used on its website and determine their purpose.

One cookie is a small file saved on the computer, smartphone or tablet of the user when consulting a website. Cookies are one of the main types of plotters, a broader term for devices that record or read information about the device used to view a site.

The use of certain cookies and other trackers also implies compliance with personal data protection obligations (GDPR), in particular with regard to informing Internet users and obtaining consent for the processing of their personal data.

The cookies may in particular be distinguished according to their purpose and origin :

  • Technical or necessary cookies : they allow the site to function correctly or to provide a service requested by the user. For example, they can be used to keep items added to a shopping cart, to maintain a connection to a customer account or to remember the choice of the language of the site.
  • Audience measurement cookies or statistics : they make it possible to measure the attendance and use of the site. For example, they can be used to determine the number of visitors, the most visited pages or the number of visits over a given period.
  • Advertising or third-party cookies : they are used to track navigation or personalize advertisements. For example, a site may include an advertising service that uses cookies to display advertisements tailored to the interests of the user.

Please note

Cookies can be placed by the company itself or by a third-party service integrated into the site. In the latter case, the company uses a service or a tool provided by another business, which may place its own cookies on the site. For example, the integration of a video player, a button or social network module to share a page or a booking or appointment tool integrated into the site, may result in the use of cookies by the provider of this service.

The company must therefore identify the cookies and other tracers used on its site and identify, for each, its origin and purpose.

Example :

One site may use a cookie to store the contents of the shopping cart, another to establish traffic statistics and another provided by an advertising service. These cookies have different purposes and are therefore not necessarily subject to the same rules.

Every cookies and others plotters do not require the consent of the user.

Some may be used without the consent of the user when they are strictly necessary for the operation of the site or the provision of a requested service. This is particularly the case with certain trackers making it possible to keep a basket, to ensure authentication or to store a language choice.

Tracers used for advertising require in principle a prior consent of the user. Certain tracers of hearing measure may also be exempted, but only when they comply with specific conditions, in particular when they are used exclusively to produce anonymous statistics for the site.

Please note

The presence of a cookie does not automatically mean that consent is mandatory. Each cookie or tracer must be examined according to its use and purpose.

To determine if consent is required, the Cnil: titleContent makes available to the user the list of cookies and other tracers identifying their purpose and the conditions under which they may be used without consent:

Cookies and trackers: how do I bring my website into compliance?

French data protection agency, Cnil

Pour en savoir plus

Where consent is required, it must be obtained before the deposit or reading of the cookie or tracer concerned. Until the user has given his consent, the tracer cannot be used.

Please note

When cookies or other trackers allow the collection or use of personal data, the company must also comply with the personal data protection obligations (GDPR).

Consent must result from a clear positive act after information on the purposes of the tracers. The consent banner must thus allow the user to make a real choice, for example:

  • Accept the tracers concerned
  • Refuse these tracers
  • Choose the purposes for which consent is given

Example :

A website uses cookies to display personalized advertisements. These cookies must not be placed before the user has accepted their use. The headband may propose « Accept everything », « Refuse All » and access to the finality setting.

The refusal must be as simple as acceptance. The mere continuation of navigation, without action expressing an agreement, does not constitute valid consent. The company must also be able to prove that consent has been obtained.

Please note

The Cnil: titleContent recommends that, when a site retains the consent of an internet user for a certain period, it also retains its refusal for the same period, so as not to ask for its choice again at each of these visits.

For consult the FAQ on the guidelines and the recommendation " cookies and other trackers » of the CNIL :

Q&A on the CNIL'S amending guidelines and « cookies and other tracers » recommendation

French data protection agency, Cnil

Pour en savoir plus

The user must be able to withdraw or change consent at any time, as easily as he gave it.

The site must therefore offer an easily accessible way to modify or withdraw the choices made, for example a link " Manage my cookies ’ or ‘ Change my choices » accessible from all pages of the site. This may take the form of a footer link or another cookie management mechanism accessible at any time on the service concerned.

Example :

An Internet user who has accepted advertising cookies during his first visit must be able to return to this choice without having to search for the browser settings or contact the company.

Withdrawal of consent must also be simple than his collection. The user's choices must then be taken into account for the cookies and other tracers concerned.

For know all the rules applicable to the use of cookies and other tracers :

Rules applicable to the use of cookies and other tracers

French data protection agency, Cnil

Pour en savoir plus

Please note

EvalRGPD allows to control the compliance of the management of cookies and more broadly of online measurement of the company's level of GDPR compliance :

EvalRGPD: the free self-diagnosis to assess a company's GDPR compliance

Who can help me?

The Public Service company Advisors

Do you have a project, a difficulty, a question of everyday life?
Simple and free: you are called back within 5 days by THE advisor who can help you.

Get a phone call with an advisor

  • By post

    3 Place de Fontenoy

    ASD 80715

    75334 Paris cedex 07

    Cnil does not receive the public and does not provide any information on the spot.

    By phone

    +33 1 53 73 22 22

    Telephone reception open Monday to Friday from 9:30 am to 5 pm.

    Legal information open on Monday, Tuesday, Thursday and Friday from 10am to 12pm.

    By email

    Access to contact form