France

IA agentique et données personnelles : la CNIL et le Conseil de l’IA et du Numérique publient une note exploratoire

Recommendation on session replay tools

On 22 April 2026, the National Commission on Informatics and Liberty (CNIL) closes the consultation on its draft recommendation on session replay tools. The draft recommendation is addressed to session replay tool providers and website and mobile application publishers. It sets out practical recommendations to ensure compliance with Article 82 of Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, the General Data Protection Regulation (RGPD), and Direct...

National Commission on Informatics and Liberty investigation into KASPR for alleged unlawful data scraping

On 4 March 2026, the National Commission on Informatics and Liberty (CNIL) closed its case concerning KASPR, a company managing a database of approximately 160 million contacts, after confirming compliance with its previous decision. The CNIL found that KASPR had fulfilled the obligations set out in Decision no. SAN-2024-020 by deleting the database, ceasing the extraction of contact details from LinkedIn, removing the automatic five-year retention renewal, implementing an email notification ...

Decree No. 2026-209 amending provisions of the public health code relating to the hosting of personal health data

On 27 March 2026, Decree No. 2026-209 amending provisions of the public health code relating to the hosting of personal health data partially enters into force. Points 2° and 3° of Article 1 are subject to a deferred application period and will apply within six months of the decree’s publication, that is by 26 September 2026. The decree implements Article 32 of Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space. It applies to patients, controllers processing personal...

Decree No. 2026-196 on the rental of furnished tourist accommodation

On 21 March 2026, Decree No. 2026-196 entered into force, regulating the transmission of activity data from rental intermediaries to government agencies. The decree designates the Directorate-General for Enterprises as the single public body responsible for collecting and making this data available. Rental intermediaries, including digital rental platforms, must electronically transmit specific data, including the registration number of the accommodation, the URL of the listing, the precise a...

French Data Protection Authority publishes guidance on deepfakes including protection and reports of illegal content

De plus en plus réalistes, les vidéos, images et sons truqués peuvent porter atteinte à la vie privée et à la réputation. Les créer ou les partager n’est pas sans risques et peut engager la responsabilité de leurs auteurs. Quels enjeux, quels risques et quels bons réflexes à adopter ?

PANAME Audit Tool AMI - Test RGPD des modeles d'IA

CNIL lance appel a manifestation d'interet pour tester l'outil PANAME d'audit RGPD des modeles d'IA. Initiative conjointe CNIL, ANSSI, PEReN, Inria pour evaluer la confidentialite des modeles AI et conformite RGPD.

Arcom and CNM inquiry into discovery, exhibition, and publishing of musical works in audiovisual media and digital platforms

On 19 February 2026, the Audiovisual and Digital Communication Regulatory Authority (Arcom) and the National Music Centre (CNM) close a public consultation as part of an inquiry into discovery, exhibition, and publishing of musical works in audiovisual media and digital platforms. The consultation asks for stakeholder input on the impact of audiovisual media and digital platforms on music discovery, talent promotion, and editorial practices, including through the role of algorithms, paid prio...

Competition Authority inquiry into competition dynamics in the online video content creation sector

On 18 February 2026, the French Competition Authority published an opinion on the competitive functioning of the online video content creation sector, following an inquiry launched in May 2024. The Authority observes that the sector is concentrated around a limited number of platforms, notably YouTube, TikTok, Instagram and, to a lesser extent, Twitch. Barriers to entry and limited substitutability between platforms contribute to creators’ dependence on a small number of intermediaries, resul...

India and France sign joint statement, covering AI

1. At the invitation of Hon’ble Prime Minister of India, Shri Narendra Modi, President of the French Republic H.E. Mr. Emmanuel Macron paid an official visit to India from 17 to 19 February 2026 and participated in the Artificial Intelligence Impact Summit 2026. During the visit, the two leaders held bilateral talks and jointly inaugurated the 2026 India-France Year of Innovation in Mumbai on 17 February. This is President Macron’s 4th visit to India and it follows Prime Minister Modi’s visit to France in February 2025. 2. On this occasion, both leaders agreed to elevate relations to a “Specia

Competition Authority inquires into competitive state of the conversational agent sector

Following the decision to start inquiries ex officio into the competitive functioning of the conversational agents sector, as announced on 9 January 2026 , the Autorité de la concurrence is launching a public consultation, as part of the preparation of its opinion.

AI chatbots to be scrutinized by French antitrust sector inquiry

Following on from Opinion 24-A-05 of 28 June 2024, which analysed the competitive functioning of the generative artificial intelligence (AI) sector, in particular the upstream segment of the value chain where generative AI models are designed and trained, and its study on the competition issues surrounding the energy and environmental impact of AI, the Autorité de la concurrence is now starting inquiries ex officio into the competitive functioning of the conversational agent sector, located downstream in the value chain. While the downstream segment of the value chain currently appears dynamic

Government investigation into X over the generation of sexist and sexual content by Grok

On 2 January 2026, the French Government announced an investigation concerning content generated by the generative artificial intelligence service Grok and disseminated on the platform X. The Government reported manifestly unlawful content to the public prosecutor and to the Pharos platform pursuant to Article 40 of the Code of Criminal Procedure in order to obtain immediate removal. The press release states that, in recent days, Grok enabled the generation and dissemination of sexist and sex...

National Commission for Information Technology and Freedoms investigation into unnamed company over unlawful transmission of loyalty programme member data to social network for targeted advertising

On 30 December 2025, the National Commission for Information Technology and Freedoms (CNIL), acting through its restricted panel, issued Ruling SAN-2025-017 in relation to its investigation into an unnamed company, referred to as company X, which transmitted data of loyalty programme members to a social network for the purpose of targeted advertising. The CNIL imposed an administrative fine of EUR 3’500’000, identifying infringements of Articles 6, 12, 13, 32 and 35 of Regulation (EU) 2016/67...

CNIL investigation into Nexpublica over alleged failure to provide sufficient security measures for PCRM software

On 22 December 2025, the French data protection authority (CNIL) fined Nexpublica France EUR 1'700'000 for failing to implement sufficient security measures for its PCRM software. Nexpublica specialises in software and computer design. The PCRM software is a tool for social workers to manage client relationships, and is used, for example, by departmental houses serving disabled people. The decision followed data breach notifications in late November 2022, where users gained access to third-pa...

Competition Authority investigation into Microsoft over allegations of abusive practices in search syndication and online advertising sectors

On 27 November 2025, the French Competition Authority rejected Qwant’s complaint against Microsoft, as well as its request for interim measures. Qwant, active in the general online search sector and partly using Microsoft technology since 2016, had alleged that Microsoft abused a dominant position and a situation of economic dependence through exclusivity, tied selling, restrictions on AI model development, and discrimination in access to search-related online advertising. The Authority outli...

National Commission on Informatics and Liberty investigation into Mobius Solutions over alleged non-compliance with data protection regulations

On 11 December 2025, the National Commission on Informatics and Liberty (CNIL) fined Mobius Solutions, an online advertising company, EUR 1 million for violations of the General Data Protection Regulation (GDPR). The investigation into Mobius followed a data breach reported by Deezer, a music streaming company that had subcontracted Mobius for advertising. Mobius, the data processor for customer data controlled by Deezer, was sanctioned on three counts. First, for breach of the data processor...

CNIL issues clarification on use of augmented cameras for selling products prohibited to minors

En quoi consistent ces dispositifs ? Certains bureaux de tabac utilisent des dispositifs de caméras « augmentées » pour estimer l’âge de leurs clients avant toute vente de produits interdits aux mineurs (tabac, alcool, jeux d’argent, etc.).

National Commission for Informatics and Liberties sandbox initiative to support artificial intelligence projects

On 11 April 2025, the National Commission for Informatics and Liberties (CNIL) published recommendations for projects supported through its sandbox initiative, focusing on AI and public services. The document provides recommendations for three projects: "Conseils Personnalisés" by France Travail, "Ekonom’IA" by Nantes Métropole, and "PRIV-IA" by the RATP. For "Conseils Personnalisés," the CNIL emphasised ensuring human intervention to avoid automated decisions, minimising data to enhance resu...

CNIL publishes recommendations on AI sandbox projects

Le « bac à sable » : un accompagnement personnalisé pour des projets innovants Le « bac à sable » de la CNIL est un programme d’accompagnement personnalisé destiné aux acteurs qui souhaitent être conseillés pour déployer un projet innovant. Il permet de bénéficier de l’expertise de la CNIL sur des problématiques émergentes.

CNIL source on AI and data protection

Official source record dated 11 February 2025 for France concerning Global data protection authorities sign joint declaration on building trustworthy data governance frameworks to encourage development of innovative and privacy-protective AI. See the linked cnil.fr source for the authoritative text, procedural context, and implementation details.

Paris Charter on AI signed

To achieve the potential benefits and preventing and mitigating the risks of emerging technologies for people and the planet, AI development, deployment and governance must be in the public interest. Public interest manifests differently for different communities, countries, and contexts, it requires opportunities for public participation, and it must serve equity and equality. We acknowledge that the mission and vision of artificial intelligence in the public interest builds on and is strengthened by existing definitions and academic research, public sector approaches, and civil society effor

Guidance on political communication tools

On 21 October 2025, the French Data Protection Authority (CNIL) issued guidance on political communication tools under the Political Advertising Transparency Regulation (PAR). The rules apply to online targeting and dissemination of political messages using personal data. The guidance provides that political actors must collect data directly and obtain explicit consent. Profiling using sensitive data is restricted. It also provides that targeting children under 17 is prohibited. A register do...

Guidance on responsibility of actors in targeted political advertising

On 21 October 2025, the French Data Protection Authority (CNIL) adopted guidance on the responsibility of actors involved in targeted political advertising. The guidance applies to sponsors, political advertising providers, and publishers engaged in developing, placing, distributing, or disseminating political adverts. Under the European Union regulation on transparency in political advertising, sponsors must disclose their identity, targets, budget, and data sources. Providers are required t...

Guidance on application of right to data portability in loyalty programs

On 14 October 2025, the French National Commission on Informatics and Liberty (CNIL) adopted guidance regarding the application of the right to data portability to loyalty programs, following inquiries from the distribution sector. The CNIL specified that Global Trade Item Number (GTIN) barcodes of purchased products, when linked to customer identification information, constitute portable data that must be transmitted upon request. Similarly, the financial amount of promotions obtained throug...

Bill on securing digital public procurement (No. 8)

On 7 October 2025, the Bill on securing digital public procurement (No. 8) was introduced to the Senate. The Bill would amend the Public Procurement Code to require that, for contracts involving the cloud hosting and processing of public data, the contracting authority set performance requirements preventing the application of foreign laws with extraterritorial effect, which could compel the contractor to disclose or transfer this data to foreign authorities. Additionally, the authority must ...

Decree No. 2025-767 on mandatory display requirements for warnings in pornographic audiovisual content simulating rape or incestuous rape

On 6 October 2025, Decree No. 2025-767 on the presentation of the warning message concerning the illegal nature of behaviours represented in pornographic content enters into force. The decree implements Articles 1-3 of Law No. 2004-575 of 21 June 2004 on confidence in the digital economy, as inserted by Article 12 of Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space. The decree establishes the exact wording of the mandatory warning for content simulating rape, aggra...

Brazilian government source on AI governance

Official source record dated 10 February 2025 for France concerning ANPD and CNIL strengthen bilateral cooperation on AI and data protection. See the linked gov.br source for the authoritative text, procedural context, and implementation details.

Data Protection Authority guidelines on deployment of web filtering

On 30 September 2025, the French Data Protection Authority (CNIL) closes the consultation on guidelines on the deployment of web filtering. The guidelines apply to public and private sector employers implementing web filtering tools for employees, contractors, or visitors using professional internet or Wi-Fi networks, excluding open public Wi-Fi providers. It outlines General Data Protection Regulation (GDPR) - compliant obligations, including limiting data collection on user ID, IP address, ...

Data Protection Authority guidelines on inactive user account data retention in digital content sectors

On 18 September 2025, the Data Protection Authority issued guidance on inactive accounts for digital content users. It applies to the audio-visual and video game sectors. Organisations must set a retention period and not keep inactive accounts indefinitely. Accounts inactive for two years should generally be deleted, with prior user notification. Data needed to access purchased content, like email, name, pseudonym, or game saves, may be kept longer. Other commercial or statistical data must b...

Data protection authorities adopted joint statement on building trustworthy data governance frameworks to encourage development of innovative and privacy-protecting AI

Primary source (pcpd.org.hk) dated 17 September 2025 in FR. See linked source for full text.

Law on designation of national authorities to implement EU AI Act

On 9 September 2025, the Directorate-General for Enterprise (DGE) and the Directorate-General for Competition, Consumer Affairs and Fraud Control (DGCCRF) published the draft law establishing the scheme for designation of national authorities responsible for implementing Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act), to be submitted to Parliament for adoption. The framework designates th...

Directorate-General for Enterprise announced draft law establishing scheme for designation of national authorities to implement EU AI Act

COMMUNIQUÉ DE PRESSE Paris, 9 septembre 2025 N°881 La DGE et la DGCCRF publient le projet de désignation des autorités nationales en charge de la mise en œuvre du règlement européen sur l’IA Afin de mettre en œuvre le règlement européen sur l’intelligence artificielle, la direction générale de la Concurrence, de la […]

National Commission for Information Technology and Civil Liberties inquiry into browsing session recording and replay tools

On 9 April 2025, the National Commission for Information Technology and Civil Liberties announced an inquiry into browsing session recording and replay tools. The inquiry aims to gather inputs to develop practical recommendations for session replay tools, which record and replay users' browsing sessions on websites and mobile applications. The inquiry applies to session replay tool providers and mobile application publishers. It seeks to address General Data Protection Regulation compliance c...

Ministry for Artificial Intelligence and Digital Affairs' lawsuit against Kick Platform over alleged proliferation of violent content online

On 26 August 2025, the Ministry for Artificial Intelligence and Digital Affairs announced a lawsuit against the livestreaming platform Kick under Article 6-3 of the Law on Confidence in the Digital Economy, which provides for the State’s ability to act against harmful or illegal content online. Article 6-3 of the Law empowers the judicial court president to order measures to prevent or stop harm from online public communication content. The decision followed the death of an individual, which ...

Paris Prosecutor's Office investigation into Kick Platform over alleged proliferation of violent content online

On 25 August 2025, the Paris Prosecutor’s Office opened an investigation into Kick Platform over the alleged proliferation of violent content online. The investigation was instituted under Article 323-3-2 of the Penal Code, following the death of an individual, which was broadcast live on the platform. The investigation seeks to determine whether Kick Platform knowingly provided illegal services by broadcasting violent content and whether it complied with obligations under the European Digita...

Regulatory Authority for Audiovisual and Digital Communication investigation into content moderation practices on Kick platform

On 22 August 2025, the Regulatory Authority for Audiovisual and Digital Communication (Arcom) condemned the unblocking of the jeanpormanove channel on the Kick platform. The channel had previously broadcast violent content linked to the death of an individual. Arcom stressed that sharing recordings with authorities does not justify restoring public access to the channel. It demanded that Kick reinstate the block without delay and warned of possible enforcement measures if the platform fails t...

Decree No. 2025-768 on establishment of a connection threshold for the temporary retention of illegal content by online platform operators

On 7 August 2025, the Decree No. 2025-768 on the establishment of a connection threshold from which online platform operators are required to temporarily retain illegal content that has been reported and removed or made inaccessible enters into force. Online platforms are defined under point (i) of Article 3 of Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act). The decree, applicable in mainland France, New Caledonia, French Polynesia, and the Wallis an...

National Commission on Informatics and Liberty inquiry into economic impact of recommendation on tracking pixels in emails

On 24 July 2025, the National Commission on Informatics and Liberty (CNIL) closes its consultation in the form of a questionnaire. The consultation seeks feedback on the direct and indirect economic impact of a draft recommendation concerning tracking pixels in emails. Stakeholders are invited to provide specific, objective, and quantified information, particularly on competitive impacts and alternative market solutions. The CNIL aims to understand the business models and economic consequence...

National Commission on Informatics and Liberty updated recommendations on development of artificial intelligence systems

On 22 July 2025, the National Commission on Informatics and Liberty (CNIL) adopted the recommendations on the application of the General Data Protection Regulation (GDPR) to the development of artificial intelligence (AI) systems. The recommendations clarify that AI models trained on personal data are often subject to data protection rules due to their memorisation risks. The guidance applies to AI developers, providers, and deployers across sectors, including health, education, and workplace...