Regulator announcement; this article does not establish payment or the outcome of any subsequent appeal.
What happened
CNIL announced a €1.5 million fine against American Express Carte France in December 2025, following its 27 November decision. It found advertising cookies placed before permission and despite refusal. It also found that previously placed cookies continued to be read after consent was withdrawn. The authority applied Article 82 of the French Data Protection Act.
Source: CNIL — original source ↗
What it means for your website
This is a useful illustration of why one screenshot of a banner proves very little. The controls need to work across different stages of a visit. Test a fresh arrival, rejection, a reload and acceptance in a separate session. Then test withdrawal manually: accepting once must not become permanent permission. Cookies already present in a browser can complicate diagnosis, so distinguish a newly created cookie from an existing one being read. GDPRFix’s automated checks cover supported public interactions; a complete withdrawal test may require manual investigation of the particular consent platform.
Three useful next steps
- Test before touching the banner.
- Check Reject followed by a page reload.
- Verify withdrawal and previously stored cookies manually.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
CNIL — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.