France: The Loi Sapin, CNIL and the Most Regulated Media Market

In France an intermediary cannot work for the seller and the buyer at the same time. The Loi Sapin, introduced in 1993 and extended to digital media by decree in 2017, requires every purchase of advertising space by an agency or intermediary to be made under a specific written agreement, with the intermediary acting strictly on behalf of the advertiser and not on its own behalf. That single rule outlaws the arbitrage model on which a great deal of programmatic media buying quietly depends, and it exists nowhere else in the world. France is, by some distance, the most transparency-regulated media market on earth.

A country analysis from Digital, Ecommerce & Performance Marketing in Europe. Not legal advice — Loi Sapin obligations depend on contractual structure and you should take French counsel before contracting. Last reviewed August 2026.

1. The Loi Sapin and what it prohibits

Sources: Loi Sapin of 29 January 1993 as described in legal analyses, and Decree No 2017-159 of 9 February 2017 extending transparency requirements to digital media. Whether a specific structure falls inside the law is a legal question turning on contractual arrangements — take French advice.

Most markets ask media buyers to disclose their margin. France requires them not to have one of that kind in the first place.

2. Why it exists, and what it means for programmatic

The history explains the design. In the early 1990s the French media market was affected by practices that had become routine — double invoicing, fictitious invoicing and over-invoicing. Media agencies could act as wholesalers, buying advertising space on their own behalf and reselling it to advertisers. Because advertisers received no invoice from the media owner, they were frequently unaware of the real price paid or of any discounts the agency had negotiated.

If that description sounds familiar, it should. It is a close relative of the arbitrage and undisclosed-margin models that have periodically surfaced in programmatic buying across other markets since. France legislated against the practice thirty years before the industry rediscovered it.

Simplified illustration. Reported commentary at the time of the 2017 extension noted uncertainty was affecting programmatic growth in France, with advertisers concerned about the cost of media transparency and publishers and intermediaries concerned about their ability to fulfil the obligations.

For anyone running French performance marketing through an international agency structure, the practical question is simple and worth asking in writing: is your French media bought under mandate, and can you see the actual price paid to the media owner?

3. CNIL is the most aggressive enforcer in Europe

France’s data protection authority enforces cookies and trackers under Article 82 of the French Data Protection Act — the ePrivacy route rather than the GDPR — and it has produced the largest penalties in the field.

Sources: CNIL enforcement reporting including the September 2025 Google decision, deliberation SAN-2025-017 of 30 December 2025 made public 22 January 2026, and CNIL’s April 2026 recommendation on email tracking pixels. CNIL can impose fines up to €20 million or 4% of global annual revenue, whichever is higher, and applies enforcement to French and international companies alike.

Note what the Google fine was actually about. Not a breach, not a transfer mechanism — advertisements displayed in an inbox without prior consent. French ecommerce marketing operates under a regulator that treats ad placement itself as an enforceable consent question.

4. Withdrawal must actually stop the tags

This is the operational trap most likely to catch a competent team, and the November 2025 American Express decision made it explicit: cookies that continue to run after a user withdraws consent are a violation, even where the withdrawal is correctly recorded.

Recording a preference change while the tags keep firing is a violation in itself. Your consent management platform saying the right thing is not the same as your site doing the right thing.

That aligns exactly with the silent-failure problem described in the European consent analysis. The difference in France is that the failure is not merely a measurement problem — it is an enforceable breach with a regulator actively monitoring websites and apps.

Based on CNIL guidance and enforcement, including conditions attached to multi-terminal consent following its April 2025 draft recommendation. CNIL has also announced it will address cross-domain consent — a single consent valid across multiple sites in the same group — during 2026.

5. Email tracking pixels now need consent

In April 2026 CNIL published its final recommendation on tracking pixels in emails, confirming that the same Article 82 consent rules governing cookies apply to them.

A tracking pixel is the invisible one-by-one image embedded in a message that reports opens. Almost every email platform in use includes them by default, and almost no French digital marketing programme treats them as requiring the same consent as a website cookie.

Based on CNIL’s April 2026 final recommendation applying Article 82 consent rules to email tracking pixels. The last row is my own distinction and should be verified — click tracking operates through a different mechanism and its treatment may differ, so take advice rather than assuming.

The strategic implication for French performance marketing is uncomfortable but clarifying: if open rates become unreliable in France, the email programme has to be judged on clicks and revenue instead. Many teams will find that healthier, since open rates were already degraded by privacy-protection features in major mail clients.

6. What the December 2025 decision teaches

CNIL deliberation SAN-2025-017 is worth studying because it describes a set of practices the regulator itself characterised as widespread.

Source: CNIL deliberation SAN-2025-017 of 30 December 2025, made public 22 January 2026, as reported in legal analyses. The inspection took place in January 2023, which indicates the timescale between examination and decision.

The first row is the one with the widest application. Uploading a customer list to a social platform for targeting is routine practice almost everywhere, and CNIL has treated doing so without valid consent and adequate information as a substantive breach.

7. The Loi Toubon and the trademark carve-out

The French Language Act of 4 August 1994 requires French in advertising, with a scope described as very broad, covering business activities targeting consumers and end users. It pursues two purposes: consumer protection and defence of the French language.

There is one practically important exception. Business names and trademarks are not affected, so a slogan registered as a trademark need not be translated — which is why international brands wanting a single global slogan are frequently advised to register it.

Sources: analyses of the Loi Toubon of 4 August 1994. Note the penalty scale — the amounts are small, so the practical risk is reputational and operational rather than financial. Note also that the sanctions are criminal in nature, which is unusual for an advertising rule, and that reported figures date from earlier commentary and should be verified as current.

The trademark route is the standard solution for international campaigns, and it is worth building into the creative process rather than discovering at translation stage.

8. Where France is easier than you expect

Having read the above, the natural conclusion is that France is the hardest market in Europe. On one significant measure it is not.

Sources: figures used elsewhere in this cluster, including CNIL’s acceptance of legitimate interest for B2B prospecting where content is relevant to the recipient’s professional role, and Didomi’s reported French consent rate of 71%. Note these measures are not directly comparable — consent rate and marketing cookie opt-in use different denominators, as explained in the consent analysis.

For French ecommerce marketing teams the Loi Sapin row deserves reframing as an advantage. In most markets an advertiser has to negotiate media transparency and hope the contract holds. In France it is the legal default, which means a French advertiser knows what its media actually costs.

9. What this page does not cover

Scope statement. The second row prevents a common confusion: Loi Sapin on media transparency and Sapin II on anti-corruption are different instruments that share a name.

10. The 90-day plan

Indicative sequencing. The first item is red because CNIL has explicitly held that recording a withdrawal while tags continue firing is itself a violation, and because the regulator monitors sites continuously.

11. Mistakes to avoid

Recurring errors in French market compliance; illustrative and not legal advice.

12. What changes next

Cross-domain consent guidance is expected. CNIL announced it would address a single consent valid across multiple sites within the same group during 2026, which matters for any group operating several French brands.

Email pixel practice has to adjust. The April 2026 recommendation is recent enough that most email programmes have not yet responded, and open-rate reporting in France should be treated as needing review.

Enforcement shows no sign of slowing. A €325 million ePrivacy fine, a €3.5 million GDPR penalty with a separate €1 million cookie sanction, and an explicit holding on withdrawal mechanics all landed within roughly twelve months.

Key Takeaways

• The Loi Sapin bars an intermediary from serving buyer and seller simultaneously and requires a written mandate — a rule with no equivalent worldwide.
• It was extended to digital media in 2017, making France the most transparency-regulated media market on earth.
• CNIL fined Google €325 million in September 2025 for displaying ads in Gmail without prior consent.
• Recording a consent withdrawal is not enough — the tags must actually stop, or it is a violation in itself.
• Email tracking pixels now fall under the same Article 82 consent rules as cookies, per CNIL’s April 2026 recommendation.
• Uploading audiences to social platforms without valid consent was penalised in a decision CNIL described as addressing widespread practice.
• Registered trademark slogans are exempt from the Loi Toubon, which is the standard route for international campaigns.

Frequently Asked Questions

Conclusion

France regulates advertising in a way no other country does, and it has been doing so since 1993. The Loi Sapin removed the undisclosed intermediary margin from media buying thirty years before the rest of the industry started arguing about it, and the 2017 extension carried that principle into digital. Alongside it sits the most active privacy regulator in Europe, one that has fined a platform €325 million over advertisements in an inbox and has now brought email tracking pixels inside the same consent regime as cookies.

The uncomfortable part for an incoming team is that most French exposure is technical rather than editorial. It is whether the tags stop when someone says stop, whether the audience upload had a proper basis, and whether the media contract is a mandate or a resale. The reassuring part is that French digital marketing rewards the same discipline this whole cluster keeps arriving at: know what your media actually costs, prove your consent signals do what they claim, and measure on outcomes rather than on a metric that a regulator has just made unreliable.