The French data protection authority CNIL has imposed a fine of €750,000 on Les Publications Conde Nast, the company responsible for Vanity Fair, for placing cookies on user devices without valid consent. The authority found that the website deployed non-essential cookies as soon as users arrived on the page, without waiting for interaction with the consent banner. CNIL said that this practice violated French data protection law and the requirements of the ePrivacy Directive, both of which mandate explicit agreement before non-essential trackers are stored on devices.
The case began after a complaint submitted in 2019, which prompted CNIL to examine the cookie practices of Vanity Fair. The initial review led to a formal warning issued in 2021. The company committed to correcting its consent mechanism, but CNIL’s follow-up checks showed that the necessary changes had not been implemented. The website continued to place advertising and tracking cookies before consent, and users who attempted to refuse cookies were still subject to tracking.
CNIL identified several violations during its investigation. Non-essential cookies were placed as soon as the homepage loaded, and the consent banner that appeared did not prevent the cookies from being stored. Some cookies used for advertising were categorised as strictly necessary, a designation meant only for technical functions that are essential for website operation. This categorisation allowed the cookies to bypass the consent requirement. CNIL also found that users who clicked the refuse option or attempted to withdraw consent were not able to prevent cookies from being placed or maintained. The authority said that the refusal mechanism did not function and that the website continued to install trackers even after users opted out.
The regulator considered the repeated failure to comply a significant factor in determining the size of the fine. CNIL stated that the publisher had already been instructed to change its practices and had been given time to update its system. The continued placement of cookies without consent and the incorrect labelling of advertising trackers as essential were considered serious breaches that affected a large number of users.
Under French law, websites must provide clear information about the purpose of cookies, identify any third parties that gain access to data, and obtain explicit user consent for all non-essential tracking. Consent must be a clear affirmative action, and users must have an easy method to refuse or withdraw it. CNIL found that Vanity Fair did not meet these requirements and that the mechanisms provided to users were misleading or ineffective.
The decision reinforces CNIL’s broader enforcement focus on consent banners and cookie deployment. The authority has issued several penalties to large online services in recent years for similar violations, signalling that consent practices remain a priority. CNIL has said it will continue to monitor websites that handle large volumes of user traffic and will take action when consent rules are not followed.
The publisher can appeal the decision, but the fine serves as a warning to any organisation operating in France that uses online tracking for advertising or analytics. The case also highlights the importance of clear consent options for users who expect to control what information is stored on their devices. CNIL has said that cookie banners must provide accurate information and must respect users’ choices without imposing artificial obstacles or implementing a design that steers users toward acceptance.