sboghossian Import: Politique de Cookies (France)
What it does
This import adapter migrates a French politique de cookies (cookie policy) skill into the mini-claude-for-legal standard format. The CNIL's September 2020 recommendation (and subsequent guidance) set specific requirements for cookie consent in France that go beyond the generic GDPR Article 6 framework: explicit, informed, and granular consent is required for all non-essential cookies before they are placed, with a dedicated consent mechanism that meets the CNIL's technical specifications.
The French cookie framework is among the strictest in the EU: the CNIL has issued enforcement decisions against major operators for non-compliant cookie banners, and fines can reach €200,000 per violation.
Import config
| Field | Source mapping | Default if absent |
|---|---|---|
policy_type |
Legacy type |
politique_cookies |
cookie_categories |
Legacy categories array |
Standard 5-category taxonomy |
consent_mechanism |
Legacy consent_tool |
cmp (Consent Management Platform) |
retention_period |
Legacy retention_days |
13 months (CNIL maximum) |
analytics_exemption |
Legacy analytics_exempt boolean |
false (requires explicit check) |
language |
Legacy lang |
fr |
output_format |
Legacy format |
full_cookie_policy_fr |
Dry-run preview
IMPORT PREVIEW — politique-cookies-FR
Source shape : French cookie policy template / checker
Cookie categories : 5-category taxonomy
Consent mechanism : CMP
Retention : 13 months (CNIL maximum)
Analytics exempt : requires verification
Language : French
Output : full_cookie_policy_fr
CNIL cookie taxonomy (5 categories)
| Category | Description | Consent required? |
|---|---|---|
| Essentiels | Session, login, shopping cart, load balancing | No — exempt |
| Analytiques | Audience measurement (e.g. Matomo, AT Internet — CNIL-approved config) | Potentially exempt if CNIL-configured; otherwise yes |
| Publicitaires | Behavioural advertising, retargeting | Yes — explicit consent |
| Réseaux sociaux | Social sharing buttons, embedded feeds | Yes — explicit consent |
| Personnalisation | User-preference storage (language, display) beyond session | Depends on purpose |
Analytics exemption (CNIL specifics)
The CNIL grants a limited exemption for analytics cookies that meet all of these conditions:
- Purpose strictly limited to audience measurement for the controller (no cross-site or cross-service sharing)
- Strictly anonymised data (no IP address stored, no cross-device linking)
- Data not combined with other processing for other purposes
- CMP must still inform users of the cookies, even if consent is not required
- AT Internet and Matomo in CNIL-approved configurations qualify; Google Analytics requires consent (CNIL deliberation 2022)
Cookie banner CNIL requirements
A compliant cookie banner must:
- Be displayed before any non-exempt cookie is set
- Offer an equally prominent "Accepter tout" (accept) and "Refuser tout" (refuse) button — the refuse option must be as easy to click as the accept option
- Allow granular consent by category
- Not use dark patterns (pre-ticked boxes, deceptive visual hierarchy)
- Record and store proof of consent (timestamp, version of policy, user ID or session)
- Allow withdrawal of consent as easily as it was given
Cookie policy mandatory content
The politique de cookies must disclose:
- Definition and purpose of cookies
- List of cookies placed: name, provider, purpose, duration, category
- How to manage cookies (browser settings + CMP)
- Consequences of refusal (functionality impact)
- Duration: CNIL maximum 13 months for consent storage; 25 months for cookie lifetime
- Link to the main politique de confidentialité
- How to contact the DPO / controller regarding cookie concerns
Common import issues
| Issue | Resolution |
|---|---|
| Banner pre-ticks non-essential cookies | Flag HIGH risk; CNIL enforcement priority |
| Refuser button harder to find than Accepter | Flag HIGH risk; equal prominence required |
| Analytics assumed exempt | Verify CNIL configuration; flag if Google Analytics used without consent |
| No consent storage | Flag HIGH risk; no proof of consent = GDPR violation |
| Policy only in English | Translate to French; Loi Toubon compliance required for French users |
Related skills
- [[import-politique-confidentialite-fr]]
- [[import-gdpr-privacy-notice-eu]]
- [[import-politique-lanceur-alerte-fr]]
- [[kb-gdpr-data-protection]]
- [[draft-privacy-notice-gdpr]]