CNIL: after cookies, security in the crosshairs

On 9 February 2026, France’s data protection regulator (France · CNIL) published its 2025 enforcement review: 83 sanctions and EUR 486,839,500 in fines, nearly nine times the 2024 total. Two decisions of 1 September 2025 account for almost all of it: EUR 325 million for Google and EUR 150 million for Shein, mainly over cookies. In May, the CNIL set its course for 2026: devoting to data security “half of its inspections and enforcement actions”.

The first ten months of 2026 confirm the shift. The largest fines now target access failures more than cookies. In 2026, the CNIL is punishing open doors more than advertising.

What is already settled

• 2025 review (France · CNIL): 259 decisions, including 83 sanctions, 143 formal notices, 31 reminders of legal obligations and 2 warnings, from 323 inspections and 20,150 complaints (up 10% year on year).
• Simplified procedure (France · CNIL): 67 of the 83 sanctions in 2025 were issued by a single member of the restricted committee, capped at EUR 20,000 and without naming the organisation. From January to early July 2026: 23 sanctions, EUR 133,750 in total, 19 of them triggered by complaints.
• Sectors targeted in 2025 (France · CNIL): 21 sanctions for cookies and trackers, 16 for video surveillance of employees, 10 for direct marketing, including 5 against candidates in the 2024 elections.
• Telecoms (France · CNIL): EUR 27 million for Free Mobile and EUR 15 million for Free (decisions of 8 January 2026), after an October 2024 intrusion affecting 24 million subscriber contracts.
• Public employment service (France · CNIL): EUR 5 million for France Travail on 22 January 2026; the injunction was closed on 23 September, with no penalty payment collected.
• Health data (France · CNIL): EUR 5 million for IQVIA Operations France on 26 May 2026, over data warehouses fed by pharmacies and doctors; EUR 500,000 for Hôpital privé de la Loire (decision of 21 July 2026), after an intrusion affecting 524,867 patients.
• Data subject rights (France · CNIL): EUR 300,000 for the consultancy Extia (21 July 2026), over erasure requests left unanswered.
• Cookies (France · CNIL): EUR 7 million for FNAC Darty Participations et Services and Fnac Direct (decision of 22 October 2026, published on 29 October), over a tracker placed without consent in their mobile app, following a complaint by the Austrian association noyb.

What is coming

• Three priority inspection themes (France · CNIL, 3 April 2026): recruitment (automated decisions, information given to candidates, retention periods), the single electoral register held by INSEE, and sports federations (health data on minors, security). They account for about 20% of inspections.
• Cybersecurity first (France · CNIL, 18 May 2026): half of inspections and enforcement actions, with attention to sectors processing sensitive data at scale, such as location data, banking data or State files.
• Transparency (EU · EDPB, with the CNIL): a coordinated European action, led by the CNIL, is checking in 2026 the information given to individuals; a European report will follow.
• Automated decisions (Netherlands · Data protection authority, with the CNIL): nearly EUR 825 million against Uber, announced on 21 August 2026, for deactivating drivers without human involvement. The original complaint was filed in France in 2020.

The real issue: security becomes the leading ground for fines

The 2025 total is misleading. Excluding Google and Shein, the other 81 sanctions add up to EUR 11,839,500. For most organisations, the risk does not look like a record fine, but like a decision worth a few thousand euros, followed by an injunction.

2026 changes the scale. By our count of decisions published as of 29 October 2026, public fines reach at least EUR 59.8 million. The two heaviest (Free Mobile and Free) punish a security failure, as do those against France Travail, IQVIA and the Loire hospital: EUR 52.5 million between the five of them. Cookies are still fined (EUR 7 million for FNAC Darty), but no longer make up most of the total. In 2025, the CNIL had already received 6,167 breach notifications, a record, half of them linked to hacking.

The missing measures are almost always the same: strong authentication, monitored logs, limited access rights. At France Travail, the CNIL noted that most of the necessary measures appeared in the organisation’s own impact assessments, but had never been implemented.

Three points to watch

1. A small fine is not a small risk. The simplified procedure handles straightforward cases and mostly starts from complaints. In 2025, 14 organisations were sanctioned for failing to respond to the CNIL; in 2026, doctors and lawyers had penalty payments collected for the same reason.

2. Anonymisation must be proven. IQVIA argued that its data was anonymous. The restricted committee found it was only pseudonymised: a unique identifier per patient and the possibility of matching with public data made re-identification possible by reasonable means.

3. Providers are within scope. At Hôpital privé de la Loire, private doctors connected without a VPN or multi-factor authentication. In December 2025, a processor was fined EUR 1 million for keeping its client’s user data after the contract ended and using it outside the client’s instructions.

What an executive team should do before 2027

1. Require multi-factor authentication on all remote access and privileged accounts, including providers and partners.
2. Have logs monitored: tested alerts on mass extractions, and a named owner to act on them.
3. Review access rights: everyone reaches only the files they handle, with at least an annual review.
4. Audit recruitment: automated screening tools, information given to candidates, retention periods. AI Act obligations for high-risk systems, employment included, will apply from 2 December 2027 (EU · European Commission), and the CNIL presents this theme as a prelude to its future supervisory role in the employment field.
5. Keep a register of rights requests, with the one-month deadline and proof of the reply.
6. Answer the CNIL on time, even when the request looks minor.
7. Check your cookie banners: refusing must be as easy as accepting.

In 2026, the CNIL no longer asks whether you have a security policy, but whether it works.

The question to ask on Monday morning

To your CISO and your DPO: “If the CNIL inspected our remote access, our logs and our recruitment tools tomorrow, what would it find?”