CNIL Analytics Consent Exemption: Requirements and Eligible Tools

The CNIL analytics consent exemption is probably the most misunderstood topic in French web regulation. This is a French-specific program run by the CNIL (French data protection authority) -- other European DPAs may have different approaches. Many site operators think that using a "GDPR-friendly" tool is enough to skip the cookie banner. That's wrong. The exemption exists, but it's governed by strict conditions that the majority of implementations fail to meet.

At DPLIANCE, we believe compliance shouldn't be a headache. But it shouldn't be an illusion either. Here's everything you need to know about the consent exemption for analytics tools under CNIL rules.

What Is the CNIL Exemption?

The Legal Framework

In France, the ePrivacy directive, transposed by Article 82 of the French Data Protection Act (loi Informatique et Libertés), establishes a clear principle: any tracker (cookie or otherwise) deployed on a user's device requires prior consent.

However, there is an exception: trackers that are "strictly necessary" for the service to function, or those whose "sole purpose is to enable or facilitate electronic communication." CNIL has interpreted this exception to include, under strict conditions, audience measurement tools.

The logic is straightforward: measuring how many people visit a site, which pages are viewed, and how to improve the service is a legitimate purpose that can be exempt from consent -- provided that measurement serves only that purpose.

What CNIL Says

CNIL has published detailed guidelines on cookies and trackers, regularly updated. Regarding audience measurement, it specifies that trackers can be exempt from consent if they meet cumulative, strict conditions.

CNIL also launched an evaluation program for audience measurement solutions, which produced a list of tools that could be configured to qualify for the exemption. This program has since been replaced by a self-assessment tool for solution providers.

Exemption Conditions

The conditions are cumulative. You must meet all of them. Missing even one is enough to lose the exemption.

1. Purpose Strictly Limited to Audience Measurement

Trackers must have a purpose strictly limited to measuring the site or application's audience. This includes:

• Measuring site performance
• Detecting navigation issues
• Optimizing technical performance or usability
• Estimating required server capacity
• Analyzing content consumption

Any other use invalidates the exemption. If data is used for marketing, targeting, personalization, or commercial optimization, the exemption no longer applies.

2. Producing Exclusively Anonymous Statistical Data

Trackers must serve to produce exclusively anonymous statistical data. Measurement results must be aggregated and must not allow identifying, directly or indirectly, any individual.

3. No Cross-referencing With Other Processing

Collected data must not be cross-referenced with other data processing. Concretely:

• No crossing with CRM data
• No matching with user profiles
• No linking with marketing campaigns
• No enrichment with third-party data

This is the condition most frequently violated in practice. Many analytics tools are connected to advertising platforms, CRMs, or marketing automation tools. These connections invalidate the exemption.

4. No Transmission to Third Parties

Non-anonymized data must not be transmitted to third parties. The measurement tool must operate exclusively on behalf of the site publisher.

This is why Google Analytics has never qualified for the exemption: collected data flows through Google's servers and feeds its advertising ecosystem.

5. No Cross-Site Tracking

Trackers must not enable global tracking of a person's navigation across different applications or websites. Each site must be measured independently.

6. Limited Lifespan

• Tracker lifespan: limited to a duration allowing meaningful audience comparison over time. CNIL recommends a maximum of 13 months, without automatic extension on each visit.
• Raw data retention: collected data must be retained for a maximum of 25 months.

7. User Information

Even with the exemption, users must be informed about the use of trackers and their right to opt out. The exemption covers prior consent, not the right to information or the right to object.

Which Tools Are Eligible?

CNIL's Evaluation Program

Since 2021, CNIL has evaluated several audience measurement solutions to verify their ability to be configured in compliance with the exemption conditions. This program produced a list of evaluated tools, available on CNIL's website.

In practice, that program produced configuration guides published on cnil.fr, one per solution. Those guides are the strongest evidence that exists: for a named tool, they describe the exact settings that bring it inside the exemption.

Since January 1, 2026, the evaluation program has been replaced by a self-assessment tool. Providers now verify their own tool against the criteria published by CNIL. The guides already published remain online.

Tool by tool: who can be exempt, and on what condition

Read the table carefully. "Guide published by CNIL" does not mean "exempt": it means a documented configuration exists which, if followed to the letter, brings the tool inside the exemption. A listed tool that is badly configured is not exempt.

AT Internet, Piano, and why the name is confusing

AT Internet is the solution people cite most when they search for the CNIL exemption — it is one of the earliest guides published, and the brand stayed associated with the exemption. Two useful clarifications:

• AT Internet was acquired by Piano in 2021. The product is now called Piano Analytics; the CNIL guide is still written under the AT Internet name.
• Like every other guide, it describes a deliberately degraded mode: no cross-site correlation, identifiers with a limited lifetime, no sharing with other processing. That is the price of the exemption, whoever the vendor is.

Contentsquare: the exemption can cover session replay

This is the most counter-intuitive point on the subject, and it deserves to be stated plainly. You often read that session replay and heatmaps fall outside the exemption by their very nature. The Contentsquare guide shows that what decides is not the nature of the feature but what it collects and what you do with it.

A session recording that captures no typed input, produces no persistent identifier, never leaves the perimeter of a single site and serves only the publisher sits in the same logic as counting page views. Conversely, a replay that records form fields or lets you find a named visitor falls out of it immediately.

Contentsquare adds a warning that applies to everyone: any new integration or feature switched on can void the exemption. An exemption qualifies a configuration at a point in time, not a product forever.

What a vendor is allowed to write

Since the update of July 4, 2025, CNIL also frames how providers may communicate. A vendor may write that "solution XXX complies with CNIL criteria and can be implemented without user consent if properly configured". It may neither claim to be CNIL-certified, nor use CNIL's logo.

That is a useful lens when comparing tools: a product page displaying a CNIL logo or claiming a "certification" already tells you something about how careful its vendor is.

Matomo: The Best-Documented Case

Matomo is the tool for which CNIL has published the most detailed configuration guide. To benefit from the exemption with Matomo, you must:

• Use Matomo in self-hosted or Cloud mode with European hosting
• Disable cross-site tracking
• Anonymize IP addresses
• Limit data retention to 25 months
• Not export data to third-party tools
• Configure the config_id for a maximum duration of 24 hours
• Not activate heatmap or session replay plugins (which may require specific consent)

The configuration is technical and requires rigor. A misconfiguration can cause loss of the exemption.

Google Analytics: Never Exempt

Google Analytics (neither Universal Analytics nor GA4) has never qualified for CNIL's consent exemption. The reasons are multiple:

• Data is sent to Google's servers (third party)
• Google uses the data for its own purposes (advertising)
• Data may be transferred outside the EU
• Google's model cannot guarantee the absence of cross-referencing with other processing

No configuration of Google Analytics can meet the exemption conditions.

Mirage Analytics and the Exemption

Mirage Analytics was designed to be compatible with CNIL exemption conditions. Its architecture meets the fundamental criteria:

• No third-party cookies, no persistent tracker: tracking is session-based, without persistent identifiers
• Sovereign hosting on Scaleway (France): no data transfer outside the EU
• Data processed exclusively for the publisher: DPLIANCE does not use the data for its own purposes
• No cross-referencing with other processing: analytics data remains siloed

For session replay and heatmaps, the same logic as at Contentsquare applies: the feature does not decide, what it captures does. A replay that masks typed input and produces no persistent identifier stays inside the perimeter; a replay that records form fields falls out of it. A case-by-case analysis remains necessary, depending on what your site puts on screen.

Since CNIL's evaluation program closed on January 1, 2026, Mirage falls under self-assessment, like any solution arriving after that date. We therefore claim no CNIL certification — nobody can, and CNIL explicitly forbids it.

Common Mistakes

Mistake 1: "My tool is cookieless, so I'm exempt"

Wrong. The absence of cookies is a necessary but not sufficient condition. A cookieless tool that transmits data to a third party, enables cross-site tracking, or is used for marketing purposes does not qualify for the exemption.

Mistake 2: "The tool is on the CNIL list, so I'm all set"

Wrong. The CNIL list (now replaced by self-assessment) indicated that the tool could be configured to qualify for the exemption. It did not certify that every installation was automatically compliant. Configuration is the responsibility of the data controller (you).

Mistake 3: "The exemption exempts me from informing users"

Wrong. The exemption covers prior consent, not the right to information. You must still inform your users about audience measurement and their right to opt out.

Mistake 4: "I can use the data to optimize my marketing campaigns"

Wrong. If you use audience measurement data to optimize campaigns, target ads, or personalize content, you fall outside the exemption's scope. The exemption covers strictly audience measurement only.

Mistake 5: "The exemption is permanent"

Wrong. The exemption conditions can evolve with CNIL guidelines. In 2025, CNIL launched a public consultation on new recommendations. In 2026, work on cross-domain consent is planned. Regular monitoring is essential.

How to Implement the Exemption Correctly

Step 1: Choose a Compatible Tool

Select an audience measurement tool that can be configured to meet all exemption conditions. Check first:

• Where data is hosted (EU required)
• Whether the tool transmits data to third parties
• Whether the tool allows limiting data retention
• Whether the tool can operate without cookies or with trackers limited to 13 months

Step 2: Configure the Tool Strictly

Apply the necessary configurations:

• Disable all data sharing with third parties
• Anonymize IP addresses
• Limit raw data retention to 25 months
• Disable cross-site tracking if you have multiple domains
• Configure tracker lifespan to 13 months maximum

Step 3: Document

Document your configuration and legal basis in your processing records. Clearly state that audience measurement is based on the consent exemption and detail the measures taken to comply with the conditions.

Step 4: Inform Users

Even without a cookie banner, you must:

• Mention audience measurement in your privacy policy
• Provide an opt-out mechanism
• Explain what data is collected and why

Step 5: Audit Regularly

Periodically verify that your configuration hasn't been altered (tool updates, parameter changes) and that exemption conditions are still met.

In practice with Mirage — Exemption is native: Mirage sets no tracker requiring consent and needs no special configuration to stay within the regulators' criteria. Check for yourself: this site runs Mirage, and it has no banner. See the features.

FAQ

Is the CNIL exemption valid across all of Europe?

No. The exemption is CNIL's interpretation of the ePrivacy directive, applicable in France. Other European authorities have different positions. If your site targets visitors in multiple EU countries, verify the positions of local authorities.

How many tools are currently eligible for the exemption?

CNIL's evaluation program favorably assessed about ten tools before being replaced by self-assessment. Among the best-known: Analytics Suite Delta (AT Internet), Matomo (with specific configuration), SmartProfile, Wysistat Business, Abla Analytics. Since January 2026, any provider can self-assess their solution.

Can I use session replay with the exemption?

Yes, under conditions. CNIL published a configuration guide for Contentsquare, whose exempt mode covers experience-analysis features, which shows the nature of the feature does not decide on its own. What counts is what the recording captures: no typed input, no persistent identifier, no cross-referencing, and a perimeter limited to a single site. A case-by-case analysis remains necessary, depending on what your site puts on screen.

Is AT Internet still exempt from consent?

The configuration guide CNIL published for AT Internet is still online and still applies: configured correctly, the solution falls within the exemption. Two clarifications: AT Internet was acquired by Piano in 2021 and the product is now called Piano Analytics, and the guide describes a deliberately degraded mode (no cross-site tracking, identifiers with a limited lifetime, no sharing with other processing).

What happens if I lose the exemption?

If your configuration no longer meets the exemption conditions, you must obtain prior user consent before deploying trackers. In practice, this means implementing a compliant cookie banner. Lack of consent constitutes a sanctionable offense.

Does the exemption cover A/B testing?

No, in principle. A/B tests serve commercial optimization purposes, not strictly audience measurement. They generally require user consent.

Sources: CNIL, "Cookies: solutions for audience measurement tools" (updated July 4, 2025); CNIL, "Audience measurement solutions exempt from consent: CNIL launches an evaluation program"; CNIL, self-assessment tool for implementing an audience measurement solution (July 2025); configuration guides published by CNIL for AT Internet (2024), Contentsquare, Piwik/Matomo, Beyable Analytics and Abla Analytics; Adobe, "CNIL Consent Exemption" (Experience League); Contentsquare, "Exemption mode" (help center); Article 82 of French law No. 78-17 of January 6, 1978 on data processing, files, and freedoms. Accessed August 26, 2026.

Looking for an analytics tool compatible with the CNIL exemption, hosted in France? Discover Mirage Analytics: cookieless web analytics, session replay, and heatmaps built in. Starting at EUR 19 excl. tax/month.