France
Full entry AI-checked Checked 5 November 2026
Read this together with European Union, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Loi Informatique et Libertés | Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés, as amended | In force | 1 June 2019 |
| Code des postes et des communications électroniques, article L. 34-5 | Article L. 34-5 CPCE | In force | 26 July 2020 |
| Code de la consommation, article L. 223-1 | Article L. 223-1 Code de la consommation, as amended by Loi n° 2025-594 du 30 juin 2025 (art. 13) | In force | 11 August 2026 |
| Bill adapting French law to EU law (DDADUE), including AI Act authorities | Projet de loi portant diverses dispositions d’adaptation au droit de l’Union européenne (Sénat n° 118 and Assemblée nationale n° 2518, 2025-2026) | Draft, not law | — |
- Loi Informatique et Libertés: France’s data protection law, read with the GDPR. First passed in 1978 and rewritten for the GDPR, with the current version in force since 1 June 2019. Article 82 sets the rules for cookies and similar trackers.
- Code des postes et des communications électroniques, article L. 34-5: Marketing by email, SMS, fax and automated calls. The date is that of the current wording. In June 2026 the Constitutional Council ruled its three overlapping enforcement clauses unconstitutional. They’re repealed on 31 October 2027 unless Parliament replaces them sooner.
- Code de la consommation, article L. 223-1: Telephone marketing to consumers. Since 11 August 2026 it needs the consumer’s prior consent.
- Bill adapting French law to EU law (DDADUE), including AI Act authorities: Passed by the Senate on 18 February 2026 and pending in the Assemblée nationale. It would name France’s authorities for the EU AI Act, with the CNIL supervising most banned practices and high-risk uses such as biometrics, employment and law enforcement.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The national law applies with the GDPR to processing in the context of a French establishment, and to non-EU organisations tracking people in France. France’s own add-on rules, such as the consent age, apply whenever the person lives in France, even if the controller isn’t established there (journalism is an exception). Online services must also tell users what happens to their data when they die and let them choose whether to pass it to someone they name.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · legifrance.gouv.fr/loda/id/JORFTEXT000000886460
Lawful bases
Section titled “Lawful bases”The GDPR’s six lawful bases apply. For sensitive data, France adds national exceptions, such as workplace biometric access control that follows the CNIL’s model regulation. Data on criminal offences can be processed only by listed actors, such as courts, public bodies, legal professionals, and people preparing or pursuing a legal claim as victim or accused.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Consent age for online services
Section titled “Consent age for online services”When an online service offered directly to a child relies on consent, the child can consent alone from 15. Under 15, the child and a holder of parental authority must consent together. Information for minors must be written in clear, simple terms they can understand.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · legifrance.gouv.fr/loda/id/JORFTEXT000000886460
Children
Section titled “Children”People can have data that an online service collected while they were minors erased promptly. If there’s no answer within a month, the CNIL decides within three weeks. The CNIL enforces the EU ban on ads based on profiling minors for platforms whose main establishment or legal representative is in France. A 2023 law requiring parental consent for under-15s on social networks never took effect, and on 14 August 2026 the Constitutional Council struck down a ban on social networks for under-15s.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · assemblee-nationale.fr/dyn/17/rapports/an/l17b2456_rapport-fond.pdf · conseil-constitutionnel.fr/decision/2026/2026911DC.htm
Cookies and similar technologies
Section titled “Cookies and similar technologies”Reading or storing information on a device needs consent, unless it’s only for communication or strictly needed for a service the user asked for (art. 82). CNIL guidance says refusing must be as easy as accepting, keeping a choice for six months is good practice, and some audience measurement is exempt under strict conditions. Its April 2026 recommendation applies these rules to tracking pixels in emails. The CNIL enforces them directly, outside the EU one-stop shop.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directric… · cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ · cnil.fr/fr/recommandation-pixel-suivi-courriels · cnil.fr/fr/faq-recommandation-pixels-courriers-electroniques
Electronic marketing
Section titled “Electronic marketing”Email, SMS, fax and automated-call marketing to individuals needs prior consent. With an opt-out at collection and in each message, you may email existing customers (not mere account holders) about similar products, and contact professionals about their job. Since 11 August 2026 sales calls to consumers (not charity calls) need prior consent, valid a year at most with proof kept at least three years, unless about a current contract or to sell newspapers or magazines. Contracts from unlawful calls are void. Calls run weekdays 10:00–13:00 and 14:00–20:00, not public holidays, unless agreed.
Sources: legifrance.gouv.fr/codes/article_lc/LEGIARTI000042155961 · cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique-sms-m… · legifrance.gouv.fr/codes/article_lc/LEGIARTI000051830285 · cnil.fr/fr/prospection-commerciale-par-telephone-hors-automate-dappel… · legifrance.gouv.fr/codes/article_lc/LEGIARTI000051830279
Breach notification
Section titled “Breach notification”Under the GDPR, notify the CNIL through its online service within 72 hours where feasible, and tell the people affected when the risk to them is high. Providers of public electronic communications services also have a national duty to notify the CNIL without delay and to keep an inventory of breaches.
Sources: cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-person… · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes
Registration and fees
Section titled “Registration and fees”No general registration or fee. Health-data processing in the public interest, such as research or health data warehouses, needs a prior formality. That’s a declaration of conformity with a CNIL reference framework or, failing that, CNIL authorisation. The CNIL rules on authorisation requests within two months, extendable once. Silence counts as approval, unless a required prior opinion wasn’t favourable.
Sources: cnil.fr/fr/sante-formalites-prealables · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Data protection officer
Section titled “Data protection officer”The GDPR rule applies with no national threshold. Appoint a DPO if you’re a public body, or if your core activities involve large-scale regular monitoring or large-scale sensitive or criminal data. Designating, replacing or removing a DPO is done only through the CNIL’s online service.
Sources: cnil.fr/fr/designation-dpo · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · eur-lex.europa.eu/legal-content/EN/TXT/HTML
International transfers
Section titled “International transfers”The GDPR rules apply, using adequacy decisions, safeguards such as standard contractual clauses or binding corporate rules, or the Article 49 exceptions. The CNIL has published a guide to transfer impact assessments. It can suspend data flows to a third country as a sanction, or for up to three months in an urgent procedure.
Sources: cnil.fr/fr/les-outils-de-la-conformite/transferer-des-donnees-hors-de… · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes
Impact assessments
Section titled “Impact assessments”The GDPR rule applies, with national lists. The CNIL’s list names 14 types of processing that always need a DPIA, such as health data handled by hospitals, HR profiling and constant monitoring of employees. A second list names processing that doesn’t. Otherwise a DPIA is needed when at least two of the nine EDPB criteria apply. Consult the CNIL first if a high risk remains.
Sources: cnil.fr/fr/analyse-dimpact-relative-la-protection-des-donnees-publica… · cnil.fr/fr/ce-quil-faut-savoir-sur-lanalyse-dimpact-relative-la-prote…
Automated decisions and AI
Section titled “Automated decisions and AI”Beyond GDPR Article 22, no court decision assessing someone’s behaviour may rest on automated profiling. Where solely automated decisions rely on a contract or consent, the controller must explain the rules and main features of the processing on request. Public bodies’ algorithmic decisions must say so explicitly. A bill naming France’s AI Act authorities, with the CNIL covering most banned practices and high-risk uses, passed the Senate on 18 February 2026 and is pending in the Assemblée nationale.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · senat.fr/dossier-legislatif/pjl25-118.html · assemblee-nationale.fr/dyn/17/dossiers/DLR5L17N53140
Penalties
Section titled “Penalties”The CNIL’s restricted committee can fine up to €20 million or 4% of worldwide turnover for the most serious GDPR breaches, and up to €10 million or 2% for others, including breaches of the national cookie rules. It can add penalty payments of up to €100,000 a day. A fast procedure for simple cases caps fines at €20,000, or €100,000 if turnover exceeds €50 million. Since a June 2026 Constitutional Council ruling, only one of the CNIL, the consumer authority and the telecoms regulator can pursue the same electronic marketing breach.
Sources: cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes · legifrance.gouv.fr/loda/id/JORFTEXT000000886460 · conseil-constitutionnel.fr/decision/2026/20261210QPC.htm
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/fr.yaml.