In a rather discreet manner, the French Data Protection Agency (CNIL) published on July 4, 2025, new rules concerning the consent exemption for audience measurement solutions. These must be implemented no later than January 1, 2026.

In this article, we review the main developments compared with the rules that have been in effect since December 2020.

✨ Key Changes

1️⃣ From Evaluation Program to Self-Assessment

Until now, the CNIL ran an official evaluation program: analytics solutions could be audited and recognized as configurable in a way that qualified them for the exemption.

👉 From now on, this system is being replaced by a self-assessment tool made available to providers. Each publisher or service provider must be able to demonstrate that their configured solution fully meets the required criteria.

2️⃣ End of the Official List of Audited Solutions

The public list of solutions evaluated by the CNIL will disappear on January 1, 2026.

👉 It will now be up to each publisher and provider to prove their compliance, whether during pre-sales discussions or in the event of a CNIL audit.

3️⃣ Exemption Conditions: Continuity, but Greater Stringency

The main principles from 2020 remain unchanged:

  • Purpose strictly limited to audience measurement,
  • Data anonymization,
  • No cross-referencing with other data processing,
  • No cross-site tracking,
  • GDPR compliance.

In 2025, these criteria are clarified and reinforced: the self-assessment process requires detailed documentation of the metrics collected and configuration parameters used.

4️⃣ Lifetime of Trackers and Data Retention

2020: clear recommendations → limited lifespan for trackers/cookies (e.g., 13 months), maximum data retention of 25 months, and periodic review.

2025: these rules remain in place, but the key point is that publishers must now provide concrete proof that these durations are effectively respected in their actual configuration, not just stated in theory.

5️⃣ Reinforced Accountability

With this new framework, the CNIL shifts full responsibility to:

  • Analytics solution providers, and
  • Website publishers implementing them.

👉 It is now up to them to ensure their configurations are compliant — and to be able to prove it at any time.

✅ In summary: The CNIL will no longer “validate” analytics tools. Each actor must now prove and document their own compliance. This marks a major shift toward greater rigor, transparency, and governance.

⚠️ What This Means in Practice

Audit your current tools: If you’re using a solution listed under the 2020 version, check its current version and configuration — and confirm that it matches your actual implementation. Don’t assume that “listed = automatically exempt.”

Use the CNIL’s self-assessment tool promptly: This is now the key mechanism for determining whether your solution can benefit from consent exemption. Keep evidence (configuration, version, active metrics, cookie lifetime, etc.).

Ensure transparency with your providers: Request configuration guides and contractual commitments to ensure they meet exemption criteria — and ask for proper documentation.

Update your internal and privacy policies: Make sure your policies reflect the right practices (lifetime, retention, anonymization, absence of cross-site tracking, or unauthorized data matching).

Prepare for the removal of the old list: The 2020 version will be removed on January 1, 2026, so you need to be fully aligned with the 2025 criteria well in advance.

💡 In Conclusion

The difference between 2020 and 2025 is not revolutionary in principle (purpose, anonymization, retention, etc.) but significant in form and responsibility. We are moving from a framework where the CNIL identified “safe” tools to one where each publisher and provider must prove their compliance. This marks a decisive shift toward self-accountability, transparency, and demonstrability.

The Optimal Ways team is ready to support you in navigating these changes. We have been working for several years alongside DPOs of leading retail and e-commerce companies, with recognized expertise in compliance and optimization of analytics solutions.

Sources: