CNIL 2025 report on sanctions and corrective measures: a tougher enforcement policy and record fines
Key figures from the 2025 report:
83 sanctions
143 formal notices
31 reminders of legal obligations
2 warnings
€486,839,500 in total fines
The CNIL (French data protection authority) has published its 2025 report on sanctions and corrective measures. While the number of sanctions remained broadly stable compared with 2024, the total amount of fines rose dramatically: €55.2 million in 2024 against €486.8 million in 2025, almost nine times as much. This increase is explained in particular by the record fines imposed on Shein and Google.
Particularly dissuasive sanctions in 2025
2025 was marked by highly dissuasive sanctions imposed on large companies, which largely explains this significant increase.
In September, the CNIL imposed record fines on:
Shein: €150 million
Google: €325 million
These decisions confirm the CNIL’s clear determination to strike hard, including against the most powerful economic players, and to ensure compliance with the GDPR.
Cookies and other trackers
Five years after publishing its guidelines and recommendations on cookies, the CNIL is markedly stepping up its enforcement policy, as illustrated in particular by the Shein and Google decisions.
According to the 2025 report, the breaches most frequently sanctioned concern:
the placing of cookies without the user’s prior consent;
insufficient information, preventing free and informed consent from being obtained;
the failure to give genuine effect to the user’s refusal or withdrawal of consent.
These decisions are a reminder that the rules on cookies are mandatory and that any breach may result in severe sanctions.
Processors: a reminder of the key obligations
A processor is the natural or legal person that processes personal data on behalf of the controller in the course of providing a service.
The CNIL points out that the processor must, in particular:
implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
process data only on the controller’s instructions;
delete the data at the end of the contractual relationship.
In addition, any processing carried out by a processor must be governed by a contract concluded with the controller.
In 2025, the CNIL sanctioned several breaches of these obligations, underlining the importance of a rigorous contractual framework for relationships with processors.
Simplified procedure
Where a case raises no particular difficulty, the CNIL may use a simplified written procedure.
Under this procedure, the administrative fine is capped at €20,000.
In 2025, the three main grounds for sanctions under this procedure were:
inadequate security of personal data;
failure to respect data subjects’ rights;
failure to cooperate with the CNIL.
According to the 2025 report, electronic direct marketing also gave rise to 10 decisions.
As a reminder, direct marketing by email is permitted subject to certain conditions:
individuals must be informed in advance;
their consent is required where they are consumers;
business recipients must be given the opportunity to object.
Video surveillance of employees
Finally, the CNIL intends to enforce strictly the legal framework applicable to video surveillance of employees.
In the absence of exceptional circumstances, linked in particular to specific security concerns or theft prevention, continuous video surveillance of employees constitutes a disproportionate interference with the protection of personal data.
The CNIL’s 2025 report confirms a change of scale in its enforcement policy.
Beyond the record amounts imposed on certain large companies, the message to all controllers is clear: GDPR obligations must be complied with in a genuine, documented and operational manner, failing which ever heavier sanctions will follow.
Sources
To go further and secure your practices in light of GDPR requirements, our expertise allows us to support you with compliance and the prevention of risks relating to personal data.