CNIL
Commission Nationale de l'Informatique et des Libertés · France
Enforcement behaviour
The CNIL is among the most aggressive DPAs in the EU, particularly on cookie consent and adtech. It consistently applies high fine percentages relative to other DPAs and has shown willingness to fine large tech companies (Google, Facebook, Amazon) in rapid succession.
Investigations typically take 12–18 months from complaint to decision. The CNIL operates a dedicated cookie enforcement unit (LINC) and publishes detailed guidelines. Non-compliance with published guidelines is treated as an aggravating factor.
Settlement/compliance pathway: formal undertaking (mise en demeure) precedes most large fines. Early voluntary compliance during investigation can reduce final fine by 20–40%.