CNIL, France's data protection regulator, issued EUR 486.8 million in fines across 83 sanctions in 2025, according to CNIL's own 2025 enforcement report published in February 2026. That is the highest annual total the regulator has ever recorded, and it happened on almost the same number of cases as 2024. Two cookie-consent decisions explain nearly all of the jump.
How much did CNIL fine companies in 2025?
CNIL closed 83 sanction cases in 2025 for a combined EUR 486.8 million, according to the regulator's own bilan published in February 2026. Of those 83 sanctions, 78 were monetary fines, 27 of which came with a daily penalty for continued non-compliance, and 16 were decided through the formal restricted-formation procedure rather than the faster simplified track CNIL uses for most routine cases.
The jump from 2024 is not a gradual trend. It is one year, driven by two cases, and the scale of that shift is the whole story behind this year's number.
How does 2025 compare to previous years?
CNIL's 2025 total is not just a record, it is an outlier against the regulator's own recent history. Annual totals ranged between roughly EUR 89 million and EUR 214 million every year from 2019 through 2023, then dropped to EUR 55.2 million in 2024 before jumping to EUR 486.8 million in 2025, according to the CMS GDPR Enforcement Tracker Report's year-by-year breakdown for France, which is built from CNIL's own published decisions.
Figure 1: CNIL's total annual fine amount, 2019 through 2025. Source: CMS GDPR Enforcement Tracker Report 2026, France country breakdown, built from CNIL published decisions.
Every prior year since 2019 stayed under EUR 215 million. 2025 more than doubled the previous record.
What is the biggest CNIL fine ever issued?
The largest confirmed CNIL fine is EUR 325 million, issued against Google in September 2025 for displaying ads between users' emails inside Gmail and placing tracking cookies on new accounts during sign-up without valid consent. It is more than double the next-largest CNIL fine and sits alongside a second September 2025 decision, EUR 150 million against Shein, for placing marketing cookies before users had a chance to consent.
Figure 2: The five largest single CNIL fines on record. Source: CNIL sanction decisions, September 2025, December 2021, January 2019, and June 2023.
Google has now drawn three separate CNIL fines since 2019: EUR 50 million in January 2019 for a lack of transparency in ad personalization, EUR 150 million in December 2021 over cookie consent, and EUR 325 million in 2025. Regulators have treated each repeat violation more severely than the last. This mirrors the pattern GDPR enforcement shows across the EU as a whole; see our GDPR fines statistics for 2026 for the continent-wide totals and the largest fine on record.
Why did CNIL's total jump 8.8x in one year?
Two decisions account for nearly all of 2025's increase. Google's EUR 325 million fine and Shein's EUR 150 million fine, both announced on the same day in September 2025 as part of CNIL's ongoing cookie-enforcement campaign, together total EUR 475 million, which is 97.6% of the year's EUR 486.8 million grand total. The remaining 81 sanctions combined added just EUR 11.8 million.
Figure 3: How CNIL's EUR 486.8 million 2025 total breaks down by case. Source: CNIL 2025 enforcement report, February 2026.
Both fines were issued under Article 82 of the French Data Protection Act, France's transposition of the ePrivacy rules governing cookies and trackers, rather than under the GDPR's cross-border one-stop-shop mechanism. CNIL, industry trackers, and most coverage still group these cases with the regulator's broader data-protection enforcement total, which is why this post counts them alongside its GDPR-specific fines.
Which violations does CNIL sanction most often?
Cookies and trackers were the most common violation type behind a CNIL sanction in 2025, present in 21 of the 83 cases, ahead of employee video surveillance at 16 cases and data security failures at 14 cases. Some cases involve more than one violation type, so category counts add up to more than 83.
Figure 4: CNIL sanctions in 2025 by violation category. Source: CNIL 2025 enforcement report, February 2026.
Sites collecting data from visitors in France face the same two gaps most often: a cookie banner that sets trackers before consent, and a privacy policy that has not been updated to reflect current CNIL guidance. A privacy policy generator built for GDPR and CNIL requirements keeps both disclosures current without waiting for a formal notice to flag the gap.
How does France's CNIL total compare across years?
| Year | Sanctions | Total fines | vs. prior year |
|---|---|---|---|
| 2025 | 83 | EUR 486.8M | +782% |
| 2024 | 87 | EUR 55.2M | -38% |
| 2023 | 42 | EUR 89.2M | -12% |
| 2022 | 21 | EUR 101.3M | -53% |
| 2021 | 18 | EUR 214.1M | +55% |
| 2020 | 14 | EUR 138.5M | +170% |
| 2019 | 8 | EUR 51.4M | -- |
Source: CNIL 2025 enforcement report (2025 row); CMS GDPR Enforcement Tracker Report 2026, France country breakdown (2019 through 2024 rows).
Summing these seven years puts France's cumulative CNIL fines at roughly EUR 1.14 billion since 2019, a total the CMS GDPR Enforcement Tracker Report 2026 says pushed France past Luxembourg in 2025 to become Europe's second-largest GDPR enforcer by cumulative value, trailing only Ireland's roughly EUR 4.04 billion.
The Bottom Line
EUR 486.8 million in a single year is a genuine record for CNIL, but the underlying enforcement pace has not changed nearly as much as the total suggests. Case volume actually fell slightly from 2024, and 97.6% of the increase traces to two cookie-consent decisions against Google and Shein. For every other business collecting data from visitors in France, the practical exposure looks a lot more like the other 81 cases from 2025: cookie banners that set trackers early and privacy disclosures that have gone stale are still the violations CNIL flags most often, and both are fixable before a formal notice arrives rather than after.
Frequently Asked Questions
How much did CNIL fine companies in 2025? EUR 486.8 million across 83 sanctions, the highest annual total in CNIL's history, according to CNIL's own 2025 enforcement report published in February 2026.
What is the biggest CNIL fine ever issued? EUR 325 million, issued against Google in September 2025 for displaying ads inside Gmail and placing tracking cookies on new accounts without valid consent, per CNIL's official decision.
Why did CNIL's total jump so much in 2025? Two cookie-consent decisions, EUR 325 million against Google and EUR 150 million against Shein, both issued in September 2025, together account for EUR 475 million, or 97.6%, of the year's EUR 486.8 million total.
How does France rank against other GDPR enforcers? France's cumulative fines have passed EUR 1 billion since 2019, overtaking Luxembourg in 2025 to become Europe's second-largest issuer by total value, behind only Ireland's roughly EUR 4.04 billion, according to the CMS GDPR Enforcement Tracker Report 2026.
Where the Numbers Come From
- CNIL. (2026). "Sanctions et mesures correctrices : la CNIL presente le bilan 2025." 83 sanctions totaling EUR 486,839,500, published February 2026.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, France." Year-by-year fine totals for CNIL, 2019 through 2025, and France's rank as Europe's second-largest GDPR enforcer by cumulative value.
- CNIL. "Sanctions." Official published register of individual CNIL enforcement decisions, including the September 2025 Google and Shein cookie fines.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Executive Summary." EU-wide cumulative total of roughly EUR 6.11 billion across 2,685 fines as of March 1, 2026, and Ireland's roughly EUR 4.04 billion cumulative total.
Note: All figures verified as of October 2026. CNIL's 2025 total reflects the regulator's own published bilan; the 2019 through 2024 year-by-year figures and the cross-country ranking are drawn from the CMS GDPR Enforcement Tracker Report 2026's France country breakdown. Fine totals are refreshed at least twice a year as CNIL publishes new decisions.
