[Enforcement library](/enforcement)

# Amazon (CNIL): ad cookies on every landing page, including the ones reached from an ad

Your banner has to appear, and hold tags back, on whatever page a visitor lands on first, not only the home page. CNIL's 2020 Amazon decision found that visitors who clicked an Amazon ad elsewhere and landed on a product page got advertising cookies with no banner at all.

CNIL · French Data Protection Act, Article 82 · Sanction adopted 7 December 2020, upheld by the Conseil d'État 27 June 2022

## The problem

Whether people typed amazon.fr or arrived on a product page from a search result or an ad, more than 40 advertising cookies were placed on their device before they did anything ([SAN-2020-013 ¶ 87](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)). The home-page banner said only: "En utilisant ce site, vous acceptez notre utilisation de cookies pour offrir et améliorer nos services" ("By using this site, you accept our use of cookies to provide and improve our services") ([¶ 89](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)). Ad-click arrivals saw no information at all ([¶ 96](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)). These are CNIL findings, upheld on appeal.

- The problem
- Case record
- What the regulator found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Regulator | CNIL restricted committee |
| Decision | SAN-2020-013, 7 December 2020 |
| Company | Amazon Europe Core SARL, Luxembourg, operator of amazon.fr (\[¶ 1\](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)) |
| Law | Article 82, French Data Protection Act |
| Stage | Appeal rejected by the Conseil d'État, 27 June 2022 (\[No 451423\](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423)) |
| Amount | EUR 35,000,000 administrative fine |
| Source review | 17 October 2026 |

CNIL now publishes this decision without the company's name, as the decision provided after two years ([CNIL sanctions list](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil)). The Conseil d'État judgment and the archived decision name Amazon.

Article 82 says reading or writing on a device "may take place only if the subscriber or user has expressed, after receiving that information, his or her consent" ([Article 82, CNIL translation in SAN-2025-005 ¶ 71](https://www.cnil.fr/sites/default/files/2025-09/cnil_sanction_shein_en.pdf)). The information must cover the purpose and "the means at his disposal to oppose it".

## What the regulator found

| Breach | What Article 82 requires | What CNIL found | Result |
| --- | --- | --- | --- |
| Cookies before consent | Consent before non-exempt cookies | More than 40 advertising cookies on arrival on any path (\[¶ 87\](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)) | Breach |
| Information on the home page | Clear, complete information on purposes and how to refuse | "Provide and improve our services" did not explain ad personalisation; no means of refusal mentioned (\[¶¶ 89, 94–95\](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)) | Breach |
| Information for ad-click arrivals | Same | No banner at all; cookies set "à leur insu" (without their knowledge) (\[¶¶ 96, 119\](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)) | Breach; aggravating factor |

Amazon argued that Luxembourg law let browser settings express consent, that an AdChoices icon offered control, and that most ad clickers were existing customers. CNIL rejected each point ([¶¶ 82–84, 99–104](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)).

## Technical issue

- **Tools or vendors:** Amazon's own advertising cookies and those of "une vingtaine" (about twenty) companies specialising in personalised advertising ([¶ 121](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)). The decision does not list cookie names.
- **Where:** the amazon.fr home page and product pages reached from search results or ads on other sites ([¶¶ 75, 87](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)).
- **When:** before any action, "fût-ce une simple poursuite de la navigation" (not even continued browsing, which the 2013 CNIL guidance had once accepted as consent) ([¶ 89](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)).
- **Scale:** about 300 million Amazon identifiers assigned in France over nine months ([¶ 123](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)).
- **How it came to light:** CNIL online inspections on 12 December 2019, 6 March 2020 and 19 May 2020, and an on-site inspection at Amazon Online France on 30 January 2020 ([¶ 2](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)). CNIL compared cookies set by the third-party site with those set on landing at amazon.fr to separate the two ([¶ 75](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)).

**Inth's technical interpretation:** the failure is architectural. The notice lived on one page while the tags lived in the shared layout that every page renders, so any entry point other than the home page skipped the notice and still fired the tags. Deep links from ads and search are a large share of e-commerce traffic, which is why CNIL treated them as the more serious case.

Illustrative pattern, not the defendant's code.

```tsx
// Bad: ad tags in the shared layout; the notice only renders on the home page
export default function RootLayout({ children }) {
  return (<html><body>
    <Script src="https://ads.example-network.com/tag.js" strategy="afterInteractive" />
    {children}
  </body></html>);
}
// app/page.tsx: <CookieNotice text="By using this site you accept cookies." />
```

Illustrative pattern, not the defendant's code. Generic consent wrapper, not a specific c15t API.

```tsx
// Fixed: banner and gate live in the layout, so every landing page gets both
export default function RootLayout({ children }) {
  return (<html><body>
    <ConsentBanner />
    <WhenGranted category="marketing">
      <Script src="https://ads.example-network.com/tag.js" strategy="afterInteractive" />
    </WhenGranted>
    {children}
  </body></html>);
}
```

## Timeline

| Date | Event |
| --- | --- |
| 12 December 2019 to 19 May 2020 | Three online inspections and one on-site inspection (\[¶ 2\](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)) |
| September 2020 | Amazon changes amazon.fr so no cookie is set before consent (\[¶¶ 82, 128\](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)) |
| 7 December 2020 | Fine and injunction |
| 8 July 2021 | Injunction closed as satisfied (\[CNIL\](https://web.archive.org/web/20221006144348/https://www.cnil.fr/fr/cloture-de-linjonction-prononcee-lencontre-damazon)) |
| 27 June 2022 | Conseil d'État rejects Amazon's appeal (\[No 451423\](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423)) |

## Outcome

CNIL fined Amazon Europe Core €35 million, citing the amount of advertising data collected, the roughly €7.7 billion 2019 turnover of the company and the "avantage financier certain" (definite financial benefit) of setting cookies before anyone could refuse ([¶¶ 124–125](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)). Even after the September 2020 changes, the new banner still did not explain ad purposes, so CNIL ordered Amazon, within three months and under €100,000 per day of delay, to inform visitors on their first page, whatever it was, of the purposes of all consent-based cookies and how to refuse them (operative part).

CNIL closed the injunction on 8 July 2021. It noted that it had not yet tested whether refusal was as easy as acceptance under its September 2020 guidelines, and reserved the right to check ([CNIL closure notice](https://web.archive.org/web/20221006144348/https://www.cnil.fr/fr/cloture-de-linjonction-prononcee-lencontre-damazon)).

The Conseil d'État rejected Amazon's challenge to CNIL's jurisdiction, the procedure and the amount, finding no need to refer questions to the Court of Justice ([No 451423 ¶¶ 16, 21, 31–32](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423)).

## What it cost

| Item | Amount or term |
| --- | --- |
| Administrative fine | EUR 35,000,000 |
| Penalty payments | EUR 100,000 per day threatened; none accrued, injunction met |
| Appeal | Rejected, 27 June 2022 |
| Payment record | Not stated in the cited record |

## Why it matters

CNIL adopted this decision on the same day as its first cookie fine against [Google](/enforcement/cnil-google). The Conseil d'État judgment confirmed that an EU company with a French sales and advertising establishment answers to CNIL for cookies on its French site, which CNIL relied on again against [SHEIN](/enforcement/shein) ([SAN-2025-005 ¶ 46](https://www.cnil.fr/sites/default/files/2025-09/cnil_sanction_shein_en.pdf)). It is separate from the Luxembourg GDPR proceedings about Amazon's ad processing, which the Conseil d'État noted ([No 451423 ¶¶ 22–25](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423)). See [cookies before choice](/enforcement/issues/cookies-before-choice-or-after-refusal) and [GDPR and ePrivacy cookie rules](/enforcement/laws/gdpr-and-eprivacy-cookies).

## How Inth catches this

- **Code audit:** flags a pull request that adds an advertising script to a shared layout outside the consent check.
- **Website audit:** records ad-domain requests on any page, including deep-linked product pages, with page, time, region and consent state.
- **Consent banner:** under the EU opt-in policy, nothing optional loads until the visitor chooses, on whichever page they land.
- **Evidence:** consent records show each choice, country and policy; runtime observations show which entry page fired which domain.

Inth cannot see cookies set by the third-party site that ran your ad before the visitor arrived; CNIL also excluded those from this case.

## Checks for your own systems

### In the repository

- Confirm the banner and tag gating live in the root layout, not on individual pages.
- Find tags in `_document`, layout files, tag-manager containers and server-rendered snippets.
- Check banner text names the advertising purpose and the way to refuse.

### In the browser and network

- In a fresh EU-geo profile, land directly on a product page with ad parameters (`?gclid=`, `?utm_source=`) and record requests before any click.
- Repeat from the home page and compare: the two should match.
- Count cookies set before consent and compare with your necessary list.

### With the people responsible

- List paid campaigns and the landing pages they use; include them in consent testing.
- Ask each ad partner which cookies it sets on landing and under what consent signal.

## Sources and limits

- [Deliberation SAN-2020-013 (archived named version)](https://web.archive.org/web/20220128203149/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729) · [current Légifrance version](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729)
- [Conseil d'État, No 451423, 27 June 2022](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-06-27/451423)
- [CNIL closure notice, 21 July 2021 (archived)](https://web.archive.org/web/20221006144348/https://www.cnil.fr/fr/cloture-de-linjonction-prononcee-lencontre-damazon)
- [CNIL list of sanctions](https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Amazon's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [CNIL v. Google](/enforcement/cnil-google) · [SHEIN](/enforcement/shein) · [Microsoft Bing](/enforcement/microsoft-bing) · [Cookies before choice or after refusal](/enforcement/issues/cookies-before-choice-or-after-refusal)