# Council of State upholds CNIL cookie banner guidance: refusal via corner link as easy as - Type: Case Law - Source: Supreme Administrative Court - Date: 2026-06-19 - Original: https://gdprhub.eu/index.php?title=CE_-_N._501417 - Canonical: https://overview.legal/posts/53908 - Topics: Consent, Cookies, Supervisory Authorities, Personal Data ## Summary Facts — Pour un RGPD Respecté, a French NGO that advocates for GDPR compliance, and three individuals requested the CNIL, the DPA, to partially repeal its 2020 recommendation on cookies and trackers. They challenged Figure 5, which showed a cookie banner where users could refuse cookies through a “continue without accepting” link placed in the upper-right corner. After the DPA rejected the request, the applicants asked the Court to annul that decision. They argued that refusing cookies was not as easy as accepting them and that the banner contradicted the positions of the DPA, the EDPB and the Belgian DPA. Holding — The Court dismissed the action. It held that the DPA’s decision did not require a specific statement of reasons under national administrative law. The Court also found that the refusal option was available on the same screen, was immediately accessible and used clear wording and a comparable font size. Therefore, refusing cookies was as easy as accepting them. The Court further held that the example did not contradict the positions of the DPA, the Belgian DPA or the EDPB. The DPA had therefore not made a manifest error of assessment. The requests for an injunction, periodic penalty payment and legal costs were also rejected. No fine or corrective measure was imposed. ## Full text Council of State, 10th Chamber, 19/06/2026, 501417, Not published in the Lebon Digest Full text Council of State - 10th Chamber No. 501417 ECLI: FR:CECHS:2026:501417.20260619 Not published in the Lebon Digest Read on Friday, 19 June 2026 Rapporteur Mr. Bruno Delsol Public Rapporteur Ms. Charline Nicolas Attorney(s) ROCHE FRENCH REPUBLIC IN THE NAME OF THE FRENCH PEOPLE Having regard to the following procedure: By an application and a reply brief, registered on 11 February and 11 April 2025 at the Registry of the Litigation Division of the Council of State, the association "Pour un RGPD Respecté" (PURR), Mr. D... Mr. B..., Mr. F... A..., and Mr. C... E... request the Council of State: 1) to annul, on the grounds of abuse of power, the decision of December 12, 2024, by which the National Commission for Information Technology and Civil Liberties (CNIL) refused their request for the partial repeal of its deliberation no. 2020-092 of September 17, 2020, adopting a recommendation proposing practical procedures for compliance in the event of the use of "cookies and other trackers"; 2) to order the CNIL, under penalty of a fine, to repeal Figure 5 of this deliberation and to publish this decision on all of its usual means of dissemination and communication; 3) to order the CNIL to pay the sum of €3,000 pursuant to Article L. 761-1 of the Code of Administrative Justice. They argue that the decision of September 17, 2020, is flawed: - by insufficient reasoning; - by a manifest error of assessment, in that Figure 5 presents an example of a cookie banner in which the acceptance and refusal actions are not equally simple, thus implementing a misleading design, in contradiction with the CNIL's own positions and those of the European Data Protection Board (EDPB), as well as with the positions taken by the Belgian Data Protection Authority, thereby contributing to the continued breaches of legislation by data controllers. In a statement of defense, filed on July 30, 2025, the CNIL requests that the application be dismissed. It argues, primarily, that the application is inadmissible and, secondarily, that the grounds raised are unfounded. Having regard to the other documents in the file; Having regard to: - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016; - the Code of Relations between the Public and the Administration; - Law No. 78-17 of 6 January 1978; - the Code of Administrative Justice; After hearing in open court: - the report of Mr. Bruno Delsol, State Councillor; - the submissions of Ms. Charline Nicolas, Public Rapporteur; Having regard to the written submission filed on 17 April 2025 by the association "For a Respected GDPR" and its co-applicants; Considering the following: 1. It appears from the case file that the association "Pour un RGPD responsable" (PURR), Mr. D... B..., Mr. F... A..., and Mr. C... E... are requesting the annulment of the decision of December 12, 2024, by which the President of the CNIL rejected their request for the partial repeal of the deliberation of September 17, 2020, adopting a recommendation proposing practical methods for achieving compliance when using "cookies and other trackers," insofar as it presents an illustration, entitled "Figure 5," of a "cookie" banner presented as compliant, on which the phrase "continue without accepting" is located in the upper right corner of the banner as a link. 2. Pursuant to point (b) of paragraph 2 of section I of Article 8 of the Law of 6 January 1978 on Information Technology, Data Files and Civil Liberties, the National Commission for Information Technology and Civil Liberties (CNIL) "establishes and publishes guidelines, recommendations or reference documents intended to facilitate the compliance of personal data processing with the texts relating to the protection of personal data and to carry out prior risk assessments by data controllers and their processors." 3. Firstly, the contested decision is not among those that must be reasoned pursuant to the provisions of Article L. 211-2 of the Code of Relations between the Public and the Administration. 4. Secondly, the applicants argue that Figure 5, illustrating the CNIL's recommendation on how to obtain users' consent to the placement and reading of trackers on their devices, violates the principle that refusing read or write operations on a user's device must be as easy to express as consenting to such operations. However, the case file shows that this illustration presents a scenario in which the option to refuse is accessible on the same screen and with the same ease as the mechanism for expressing consent, and with a comparable size; that the wording of the link is clear and explicit; and that the link is located in the top right corner in an immediately accessible area. Furthermore, it does not contradict the CNIL's own doctrine, nor that of the European Data Protection Board (EDPB), nor, in any event, that of the Belgian data protection authority. Consequently, the argument that the refusal to amend the contested recommendation is tainted by a manifest error of assessment must be dismissed. 5. It follows from all of the above, without the need to rule on the objection of inadmissibility raised by the CNIL, that the association "Pour un RGPD Réspecté" and others are not entitled to seek the annulment of the decision they are challenging. Therefore, their claims for injunctive relief and those submitted under Article L. 761-1 of the Code of Administrative Justice must also be dismissed. DECIDES: Article 1: The application of the association "Pour un RGPD Réspecté" and others is dismissed. Article 2: This decision will be notified to the association "Pour un RGPD Réspecté," the first-named applicant on behalf of all the applicants, and to the National Commission for Information Technology and Civil Liberties (CNIL). Deliberated at the close of the session of April 16, 2026, at which the following judges were present: Mr. Bertrand Dacosta, presiding judge; Mr. Olivier Yeznikian, State Councillor; and Mr. Bruno Delsol, State Councillor-Rapporteur. Delivered on June 19, 2026. The President: Signed: Mr. Bertrand Dacosta The Rapporteur: Signed: Mr. Bruno Delsol The Secretary: Signed: Ms. Marie-Léandre Monnerville The Republic directs and orders the Prime Minister, insofar as it concerns him, or any judicial officers, as required, with respect to ordinary legal proceedings against private parties, to ensure the execution of this decision. For proper dispatch, For the Litigation Secretary, by delegation: No. 501417-2 - ECLI:FR:CECHS:2026:501417.20260619 Legifrance Help To assist you in using the site, consult all the available help on the Legifrance website. Contact us Watch Legifrance video tutorials Use Case Guide Subscribe to the Official Journal of the French Republic Receive the summary by email as soon as it is published. Learn more about managing your data and your rights. Your email address (e.g., name@example.com) By providing your email address, you agree to receive the summary of the Official Journal of the French Republic by email. You can subscribe or unsubscribe at any time using this form. Help Contact Us Open Data and API Open Data and API API FAQ French Republic The Légifrance website is under the editorial responsibility of the General Secretariat of the Government (SGG). Its editorial design, updates, and technical maintenance are provided by the SGG and the Directorate of Legal and Administrative Information (DILA). service-public.gouv.fr data.gouv.fr info.gouv.fr About this version | Update Information | Legal Notice | Privacy Policy | Sitemap | Open Data and API | Accessibility: Partially compliant | Ecodesign | API FAQ | Site Availability ## Cited law provisions (3) ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-8-en Conditions applicable to child's consent in relation to information society services --- Generated by overview.legal · https://overview.legal/posts/53908 · 2026-08-22