In short. An AI referral leaves France’s analytics cookie consent requirements unchanged because the assessment concerns tracking purposes and exemption conditions.
Definition: An AI referral is a website visit through a link supplied by an AI assistant. Under France's cookie rules, that origin leaves analytics cookie consent requirements unchanged: consent depends on the tracking purpose and whether an exemption applies.
As of 17 October 2026, CNIL's cookies guidance requires prior consent for reading or writing trackers unless an exemption applies. Its audience measurement guidance describes a conditional exemption for measuring website usage.
Key facts
- CNIL's audience measurement guidance limits the exemption to measurement for the publisher's exclusive account, producing anonymous statistics only.
- Article 82 of the French Data Protection Act provides exceptions for communication transmission and operations strictly necessary for an online service expressly requested by the user.
- CNIL's website compliance guidance treats continued browsing as refusal where consent is required.
- CNIL's analytics developer sheet warns that national interpretations of the ePrivacy rules can vary.
Why does the referral source leave the rule unchanged?
Article 82 of the French Data Protection Act regulates access to information stored on a user's device and writing information to it. Its exceptions concern the purpose and necessity of those operations.
Applying that test to an AI referral gives the same consent assessment as for another arrival route. Clicking an assistant's link is not itself consent to analytics tracking on the destination website. The operator must assess the trackers used there against the applicable exceptions.
This entry follows France's framework. CNIL's developer guidance explicitly advises checking the local data protection authority's position for national variations.
When can audience measurement qualify for exemption?
Audience measurement means collecting statistics about visits to a website or application. CNIL's exemption criteria require a purpose strictly limited to that measurement, for the publisher's exclusive account, and anonymous statistical output.
The criteria exclude combining the data with other processing, transmitting non-anonymous data to third parties, and tracking navigation across different websites or applications. An assistant referral supplies no additional exemption from these conditions.
The same guidance recommends informing users through the privacy policy. It also asks publishers to obtain evidence from providers about the configuration that meets the criteria.
How should a website handle consent?
CNIL's compliance guidance requires information and consent before placing or reading trackers that need permission. For an AI referral landing page, the practical check is whether those operations wait for the visitor's choice.
The same guidance recommends choices by purpose. Its banner example offers “tout accepter” and “tout refuser” at the same level and in the same format. It also gives a footer link as a way to let users withdraw consent at any time.
A review can therefore check the page before a choice, after refusal, and after acceptance against these requirements. This applies the documented consent rules to the destination page regardless of how the visitor arrives.
Related terms
FAQ
Do I need a separate consent banner for AI referrals?
Referral origin alone creates no separate banner requirement under Article 82. The consent assessment concerns the destination website's reading and writing operations and their purposes.
Can I treat every analytics cookie as necessary?
Only measurement meeting the applicable exemption conditions qualifies. CNIL's guidance requires assessment of the actual configuration, including restrictions on data combination and tracking across sites.
Can I interpret continued browsing as acceptance?
CNIL's consent guidance requires a positive action after information is provided. Cookies subject to consent must wait until that consent is given.
Does an exemption remove personal-data obligations?
CNIL’s compliance guidance states that associated personal-data processing remains subject to data protection principles even when the tracker is exempt from consent.
Sources
- CNIL, "Cookies et traceurs : que dit la loi ?", 29 September 2020
- CNIL, "Cookies : solutions pour les outils de mesure d'audience", 4 July 2025
- CNIL, "La loi Informatique et Libertés", Article 82, accessed 17 October 2026
- CNIL, "Cookies et traceurs : comment mettre mon site web en conformité ?", 1 October 2020
- CNIL, "Sheet n°16: Use analytics on your websites and applications", 11 June 2020
Check how a page reads to answer engines. Open the GEO score analyzer