CNIL Annual Report: 2025 Fines and Sanctions

The French Data Protection Authority (CNIL) has released its 2025 annual report, detailing significant enforcement actions. In 2025, the CNIL issued 83 sanctions totaling €486,839,500, including 78 fines and 16 decisions by its restricted committee. Key areas of enforcement included non-compliance with rules on cookies and other trackers, leading to substantial fines for two major entities, and violations related to the video surveillance of employees, resulting in sanctions for 16 organizations. The report also highlights enforcement against subcontractors and cooperation with European counterparts under the GDPR's one-stop-shop mechanism.

This report indicates a robust enforcement posture by the CNIL, particularly concerning digital advertising technologies and employee privacy. Regulated entities operating in France, especially those handling personal data, should review their practices related to cookie consent, employee monitoring, and data security to ensure compliance with GDPR requirements. While specific compliance deadlines are not detailed for past actions, the substantial fines and the ongoing focus on these areas underscore the importance of proactive compliance efforts to avoid penalties and corrective orders.