Cookies placed without consent: the company that publishes the website “vanityfair.fr” fined 750,000 euros by the CNIL

Background information

The company LES PUBLICATIONS CONDE NAST publishes printed and online magazines, including the magazine Vanity Fair.

In December 2019, the CNIL received a public complaint from the association NOYB concerning the cookies placed on the devices of users visiting the “vanityfair.fr” website. After several investigations and discussions with the CNIL, the company received an order to comply in September 2021 and the proceedings were closed in July 2022.

In July and November 2023, then again in February 2025, the CNIL carried out further online investigations on the “vanityfair.fr” website. Based on these findings, the restricted committee – the CNIL body responsible for issuing sanctions – considered that the company LES PUBLICATIONS CONDE NAST had failed to comply with the obligations of the French Data Protection Act (Article 82), and imposed a fine of 750,000 euros.

The amount of this fine takes into account the fact that the company had already been issued with an order to comply, as well as the number of people affected and the various breaches of the rules protecting users with regard to cookies.

Sanctioned breaches

The restricted committee sanctioned several of the company's practices that were contrary to the French Data Protection Act (Article 82):

• Failure to obtain users consent before placing cookies: the CNIL found that cookies subject to consent were placed on the devices of users visiting the "vanityfair.fr" website as soon as they arrived on the site, even before they interacted with the information banner to express a choice.
   
• A lack of clarity in the information provided to users: some cookies appeared as ‘strictly necessary’ cookies and therefore as exempted from the obligation to obtain users' consent, without any useful information about their purposes being made available to users.
   
• Ineffective mechanisms for refusing and withdrawing consent: when users visiting the “vanityfair.fr” website clicked on the “Refuse all” button placed in the banner, or when they decided to withdraw their consent to the installation of trackers on their device, new cookies subject to consent were yet placed, and other cookies that were already present continued to be read.