France. ePrivacy / marketing. Act
Art 82 LIL / CPCE L34-5Article 82 of Law 78-17 (cookies) and Article L34-5 of the Postal and Electronic Communications Code (CPCE) (direct marketing)
Partly verified
Medium confidence.Legifrance article identifier for Art 82 not re-verified.
§1Summary
- Synopsis
France requires prior consent for non-essential cookies and trackers, and opt-in for e-mail/SMS marketing to individuals with a soft opt-in for existing customers. The CNIL treats refusing cookies as needing to be as easy as accepting.
- Key themes
- Unique features
The CNIL is the EU's most active cookie enforcer, issuing nine-figure fines to large platforms; because Art 82 is national law the GDPR one-stop-shop does not apply.
- SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- CNIL fines under LIL Art 20 (up to €20m/4% scale); DGCCRF fines for L34-5
§3Dates
- Key dates
- Adopted
- In force
- Art 82 reflects ePrivacy 2009 changes transposed by Ordinance 2011-1012; CNIL cookie guidelines and recommendation of 17 Sept 2020
§4Text and authority
- Text
- Authoritative text legifrance.gouv.fr
- Authority
- CNIL (cookies and marketing); DGCCRF also enforces L34-5
§5Where it applies
- Domestic law of
- France
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Legifrance article identifier for Art 82 not re-verified.