CNIL Enforcement: Practical Lessons From The American Express Cookie Fine

On 30 November 2023, the French Data Protection Authority (the "CNIL") issued a EUR 40,000 fine against American Express Carte France for shortcomings in its cookie consent banner. Although the monetary value was modest, the decision highlights the CNIL's increasingly standardised expectations for cookie consent and provides practical guidance for organisations operating in France.

Analysis of Key Violations

The CNIL's enforcement action focused on three key areas, reflecting an alignment with broader European regulatory interpretation:

1. Lack of Prior Consent

Analytics and tracking cookies were deposited before users made any choice—an approach strictly incompatible with Article 82 of the French Data Protection Act. This point reflects the core position set out by the EDPB in Guidelines 05/2020 on Consent, which provides that non-essential cookies require valid, prior, affirmative consent.