CNIL analytics self-assessment: what the exemption asks and where we stand

If you run a website for visitors in France or the EU, you have probably asked this: does my analytics need a consent banner? The CNIL, the French data protection authority, publishes a limited exemption for audience-measurement trackers. This page turns that guidance into a checklist you can run yourself, then states plainly where the Hitsteps tracker stands.

This is a factual self-assessment, not legal advice. Whether your site needs a consent banner is your decision to make with your own legal advisor. Nothing here promises compliance or an exemption, for us or for you.

Last updated: 30 October 2026

What the CNIL exemption requires

Audience-measurement trackers are exempt from prior consent only when every condition below holds. These are the conditions as published in CNIL Sheet n°16, "Use analytics on your websites and applications" (11 June 2020):

  1. Visitors are informed that the trackers are used.
  2. Visitors can object to their use.
  3. The purpose stays limited to audience measurement, plus A/B testing.
  4. The data is not cross-checked with other processing, such as customer files or visit statistics from other sites.
  5. The tracker is limited to a single site or application publisher.
  6. The last byte of the IP address is truncated.
  7. The lifetime of the trackers is limited to 13 months.
  8. When every condition holds, the regime moves from opt-in to opt-out. Visitors must still be able to refuse.

The CNIL recommendation of 17 September 2020 adds practical limits: a tracker lifetime of 13 months that is not automatically extended on new visits, collected information kept at most 25 months, and a periodic review of both periods. The CNIL also publishes a self-assessment tool for audience-measurement solutions (July 2025), and warns that most large audience-measurement offerings do not fall within the scope of the exemption, regardless of their configuration.

Run the self-assessment on your own setup

The CNIL self-assessment tool asks concrete questions about the tool you use. Each criterion below is written so that meeting it supports the exemption. Work through them for your setup:

  • The solution is used only for audience measurement of your site or application.
  • It cannot follow a person outside your site or application.
  • It imports no outside data, and reads no customer, UTM or campaign identifiers from your URLs.
  • No identifier it uses tracks a person across multiple domains.
  • Browser identifiers it sets, such as cookies, are at least first-party.
  • IP-based location is limited to the city level and then pseudonymized by removing at least the last byte.
  • If devices are fingerprinted, the hash calculation includes a site-specific component and a time component.
  • Tagging that could recover personal information, for example through forms, is excluded.
  • Cross-site reach measurement and deduplication are switched off.

A criterion you cannot meet points away from the exemption. The cookie and fingerprinting criteria apply only when the tool uses those technologies. The CNIL tool is the full questionnaire; this list is a partial reading of it.

Where Hitsteps stands: not exempt

We would rather be straight with you than win a checklist. Here is what the Hitsteps tracker does, and which exemption criteria those facts touch:

  • It stores identifiers in the visitor's browser: cookies such as _uidx and unique_id, plus local storage entries. Cookies and bounded identifiers are contemplated by the CNIL rules when the other conditions hold.
  • It recognizes returning visitors across days. The stored identifiers live far longer than one visit, and campaign identifiers like camp are part of the measurement. Bounded returning-visitor recognition is compatible with the exemption; collecting campaign identifiers for marketing measurement is not.
  • It sends visit data to the servers that run Hitsteps and keeps the visit history your reports read. The CNIL questionnaire contemplates processor-hosted storage, so hosting alone is not the gap.
  • It measures more than aggregated anonymous audience: traffic campaigns, company identification, cross-device journeys and visitor-level reports are product features. The exemption asks for marketing measurement to be off and reports to hold only anonymous statistics. Campaign and UTM collection and individual visitor histories are where the tracker departs from those criteria.

So the honest position is this: we do not claim the CNIL exemption, and we do not claim that a site using Hitsteps can skip a consent banner. If you use us for EU visitors, treat consent as your own call to make, with your legal advisor and the CNIL guidance in hand.

What you can do next

  • Read the privacy policy for the full cookie list, what is collected and how long it is kept.
  • Point visitors to the visitor opt-out. The tracker checks the opt-out before it records a visit.
  • Use the GDPR privacy controls in the dashboard for consent and data-minimization settings on your site. You stay responsible for your own legal requirements.
  • Questions about how Hitsteps handles data? Contact us and we will answer plainly.

Common questions

Is the Hitsteps tracker exempt from CNIL consent rules?

No. Cookies and returning-visitor recognition alone would not settle it either way; the CNIL rules contemplate both within limits. The tracker collects campaign and UTM data for marketing measurement and keeps visitor-level histories rather than only anonymous statistical reports, and those are the criteria it does not meet. We make no exemption claim.

Does that mean every site using Hitsteps must show a consent banner?

That is your legal assessment to make, not ours to make for you. We promise no compliance outcome and no way around a banner. The checklist above and the CNIL sources are the facts we can honestly give you.

What does the audience-measurement exemption actually cover?

A narrow opt-out regime for strictly scoped audience measurement: visitors informed and able to object, no cross-checking with other data, single-site scope, truncated IP, and tracker lifetime of 13 months or less. Most large analytics offerings do not qualify.

Where can I read the CNIL sources?

Sheet n°16 "Use analytics on your websites and applications", the guidelines and recommendation on cookies and other trackers of 17 September 2020, and the July 2025 self-assessment tool for audience measurement, all published on cnil.fr.

Sources

The exemption criteria and the self-assessment checklist above read from these CNIL publications. The product facts describe the Hitsteps tracker itself:

CNIL guidance applies to French law and the ePrivacy rules as implemented in France. Other EU data protection authorities publish their own positions. Check with yours.