Do I need a cookie banner for analytics in France?
The CNIL's guidelines exempt audience measurement from consent when it serves only the publisher, produces anonymous statistics, is not combined with other data or passed on, and follows nobody across sites; it keeps a list of the conditions and a self-assessment tool.
The rule
- Supervised by
- National Commission on Informatics and Liberty (Commission nationale de l'informatique et des libertés) (CNIL)
- Written in
- French Data Protection Act (Loi Informatique et Libertés), Article 82
The conditions of the exemption
- The measurement is strictly limited to the audience of your site or app, for your own account only
- It produces anonymous statistics only
- The data is not combined with other processing and not passed to third parties, except anonymised
- No visitor is followed across sites or apps
- A tracker lives at most thirteen months and is not extended on a return visit; raw data is kept at most twenty-five months
- Visitors are informed, and the setup is reviewed from time to time
What the regulator and the courts have said
- 4 July 2025: Cookies: solutions for audience measurement tools The CNIL restates the conditions and publishes a self-assessment tool for measurement tools; tools that meet them need no consent, tools that do not, Google Analytics among them, need it.
- 17 September 2020: Guidelines on cookies and other trackers (deliberation 2020-091) The CNIL's guidelines, adjusted after the Conseil d'État's ruling of June 2020, set out which trackers are exempt from consent: among them audience measurement under the conditions above.
Tool by tool
The same question for the tools people use most. Tools that work without cookies get the same verdict as Nvivio.
| Tool | Banner needed? | Why |
|---|---|---|
| Google Analytics 4, as it ships | Yes | Sets the cookies _ga and _ga_<id> for two years to tell users apart. Cookies that identify a browser for two years are neither strictly necessary nor anonymous audience measurement, so France asks consent for them. |
| Google Analytics 4 with consent mode | Yes | Consent mode adapts Google's tags to the choice a visitor made in a banner. It is a way to handle consent, not an exemption from it. |
| Matomo without cookies | No | With cookies turned off and the IP address shortened, it stores nothing on the device and measures only for you. |
| Plausible or Fathom | No | No cookies and no identifier that lasts beyond a day, measurement for you only. |
| Nvivio, privacy mode | No | No cookie, nothing on the device, the IP address never stored, a visitor code that changes every day, reports as totals. |
| Nvivio, cookie mode | Yes | Places one first-party cookie to recognise a visitor over months. That needs consent, and Nvivio says so. |
| Heatmaps and session recordings | Yes | They record what one visitor did, usually with a cookie, and are never only audience measurement. |
What changes with the Digital Omnibus
The EU is rewriting the cookie rule. Both the Commission's proposal and the Council's mandate exempt aggregated audience measurement by the provider of a site, or by a third party on its behalf, from consent. The text is not law yet.
France already exempts privacy-friendly audience measurement through its regulator. The Digital Omnibus would put a similar exemption into EU law, with its own conditions, which would then replace the CNIL's wording; for measurement like Nvivio's the answer stays no banner. Where the Digital Omnibus stands
Set it up without a banner
Three steps, in the order that keeps you on the right side of the rule in France.
- Add the Nvivio script to your site in privacy mode, the default: no cookie, nothing on the device.
- Mention Nvivio in your privacy notice, with the objection box, so visitors can opt out with one click.
- If you keep another tool that sets cookies, load it only after consent, or drop it.
Frequently asked questions
Is first-party analytics exempt from consent in France?
Yes, under conditions: measurement for your own site only, statistics that identify nobody, no tracking across sites, and visitors told about it. First-party alone is not enough; a first-party tool that profiles visitors still needs consent.
Does Google's consent mode v2 remove the banner?
No. Consent mode tells Google's tags what the visitor chose in your banner and sends cookieless pings when consent is refused. It presumes a banner; it does not replace one, and the pings themselves are not covered by any exemption in France.
Can I keep Google Analytics 4 next to Nvivio?
Yes, as long as Google Analytics loads only after consent. Nvivio measures everyone in privacy mode, so you keep complete numbers; Google Analytics then shows the consenting part, with its own tools and its data in the United States.
My visitors come from several countries. Which rule applies?
The rules of every country whose residents you measure, not only the one you are in. Follow the strictest country that matters to you, or load the tool that needs consent only after consent there. A tool that needs no consent anywhere, like Nvivio in privacy mode, avoids the question.
Is this legal advice?
No. It is general information, checked against the sources below on the date shown. Rules and readings change; a decision for your site is yours, or your adviser's.
Nearby countries
Sources
- CNIL, solutions for audience measurement tools: Cookies : solutions pour les outils de mesure d'audience (cnil.fr) · accessed 4 November 2026
- CNIL, measuring the audience of your sites and apps: Mesurer la fréquentation de vos sites web et de vos applications (cnil.fr) · accessed 4 November 2026
- CNIL, guidelines and recommendation on cookies: Lignes directrices modificatives et recommandation (cnil.fr) · accessed 4 November 2026
- CNIL, what the law says: Cookies et autres traceurs : que dit la loi ? (cnil.fr) · accessed 4 November 2026
This is general information, not legal advice.