CNIL Consent-Exempt Analytics: A 2026 SaaS Checklist

France's data regulator quietly changed the rules that decide whether you can measure your website's traffic without a cookie banner. Since 1 January 2026, the CNIL has stopped publishing a list of pre-approved analytics tools and moved to a self-assessment model: vendors must now verify their own compliance against published criteria, and publishers stay responsible for implementing the tool correctly (Global Relay). For SaaS teams, that shifts the burden of proof onto you — a vendor badge that says "CNIL-exempt" is now a self-declaration, not a regulator's stamp.

This matters well beyond France. The consent-exempt criteria the CNIL codified — strictly first-party, single-purpose, no cross-site tracking, truncated IPs, capped retention — are the de facto template for what "privacy-friendly analytics" actually means in Europe, and they map closely to how the wider EU is trending. This post turns the CNIL criteria into a pass/fail checklist a SaaS founder or growth lead can run against their own stack, and explains what to do with the traffic gap when your primary tool does not qualify.

What actually changed: from approval list to self-assessment

The headline change is procedural but consequential: the CNIL retired its evaluation program and replaced it with a self-assessment tool published alongside its revised guidance on audience-measurement solutions. Under the old regime, the regulator reviewed specific tools and effectively blessed them as consent-exempt, giving publishers a shortlist to pick from. Under the new regime, every analytics provider is invited to test its own product against the criteria and attest to compliance, while the website or app publisher remains on the hook for correct deployment.

For a buyer, this removes a convenient shortcut. You can no longer point to a regulator's approved list as your defence; you have to understand the criteria and confirm that both the tool and your configuration meet them. That is not a bad thing — it forces a level of literacy that most teams skipped when they simply installed GA4 and bolted a consent banner on top. The rest of this guide is that literacy, condensed. If you want the broader European backdrop this sits inside, the EU Digital Omnibus cookie-rules explainer covers the legislative direction of travel that is nudging analytics toward consent-exempt, first-party measurement.

The exemption checklist: seven conditions, all mandatory

The exemption is conjunctive: you must satisfy every condition, not most of them. In plain terms, a consent-exempt analytics setup must be first-party only with no cross-site or cross-app tracking; used for the single purpose of measuring the publisher's own audience; free of any third-party data sharing or combination with other datasets; built on pseudonymized data with truncated IP addresses; capped at a 13-month lifetime for any cookie or identifier; and limited to a narrow set of collected events. The commonly cited summary is blunt: "first-party only, no cross-site tracking, no third-party data sharing, 13-month cookie limit" (CookieChimp).

The event-scope condition is the one teams underestimate. An exempt solution may collect only a tight set of event categories — broadly, page views with basic context, interactions with site features (which link or button, where it led), and performance or loading statistics such as time on page and scroll (DPLIANCE). The moment you start capturing richer behavioral events tied to an individual profile, you have left audience measurement and entered product analytics — which is legitimate, but no longer exempt. That boundary is exactly the product-analytics-versus-web-analytics distinction drawn in privacy law rather than in a feature comparison.

Why Google Analytics fails the test

Google Analytics has never qualified for the CNIL exemption, and that has not changed in 2026. Neither Universal Analytics nor GA4 meets the criteria, because the platform's identifiers, cross-property data model, and data flows sit outside the first-party, single-purpose, no-sharing constraints the exemption demands. The consequence is concrete: if you run GA4 in France, you need a consent banner, full stop. There is no configuration that turns GA4 into an exempt audience-measurement tool.

That banner is not free. Every visitor who declines becomes an invisible row in your acquisition data, and decline rates on analytics cookies are rarely trivial. The result is a systematic undercount that hits the top of your funnel hardest — precisely the numbers you use to judge which channels are working. We walk through the size and shape of that distortion in the consent-decline acquisition-gap analysis, but the short version is that a consented-only measurement stack quietly lies to you about your cheapest growth channels.

Cookieless is necessary, not sufficient

A cookieless tool clears the biggest hurdle but does not automatically win the exemption. The consent requirement in ePrivacy Article 5(3) is triggered by storing or reading information on the user's device. A tool that writes nothing — no cookie, no local storage, no device fingerprint — does not trip that specific wire, which is why cookieless analytics can run without a consent prompt on storage grounds. That is the mechanism behind the "no storage, no access, no consent trigger" reasoning that privacy-friendly vendors lean on.

But GDPR still governs whatever personal data the tool processes, so the CNIL criteria around first-party use, IP truncation, retention limits, and no third-party sharing remain in force even for a storage-free tool. A cookieless product that shipped truncated data to a third-party ad platform, or that stitched a visitor across multiple client sites, would still fail. Treat "cookieless" as clearing condition one of many, not as a blanket exemption. For teams weighing where their data physically lives and who controls it, the self-hosted analytics and data-ownership guide covers the architectures that make first-party, no-sharing compliance easiest to prove.

A practical stack: exempt measurement plus consented depth

The pragmatic pattern for a privacy-conscious SaaS is a two-layer stack: a consent-exempt, cookieless tool for accurate top-of-funnel audience measurement, and a consented product-analytics layer for the deeper, identity-linked behavioral analysis you need for activation and retention. The exempt layer runs for every visitor and gives you honest traffic, source, and landing-page counts with no banner drag. The consented layer runs for users who opt in and powers funnels, cohorts, and per-user event streams.

This split resolves the tension between accuracy and compliance instead of forcing a single tool to be both. Your acquisition reporting stops being distorted by consent declines, because the exempt layer counts everyone; your product analytics stays legally clean, because the identity-rich events only fire with consent. The one discipline this demands is a clear definitional boundary between "audience measurement" and "product analytics" in your own tracking plan — which is a governance problem more than a legal one, and the same event-taxonomy and tracking-plan discipline that keeps any analytics implementation trustworthy.

Run the assessment: a five-step audit

Turn the criteria into an audit you can complete in an afternoon. First, list every analytics and tag script firing on your site and classify each as audience measurement or product analytics. Second, for each audience-measurement tool, walk the seven conditions above and mark pass or fail — first-party, single-purpose, no sharing, truncated IP, 13-month cap, event scope, and no dataset combination. Third, confirm whether the vendor publishes a self-assessment or compliance statement you can retain as evidence, since the burden of proof now sits with you.

Fourth, for anything that fails — GA4 being the usual culprit — decide whether to gate it behind consent or replace it with an exempt tool for the measurement job. Fifth, document the decision and the retention settings, because regulators increasingly expect a written basis, not a verbal assurance. The same instinct applies across the US state-law landscape, where cure periods are expiring and first violations now draw enforcement rather than warnings; the US state privacy-law compliance guide covers that parallel shift for teams operating on both sides of the Atlantic. Done once, this audit turns a fuzzy compliance worry into a concrete, defensible configuration.