When a French small-business website shows a cookie banner, it is more likely than anywhere else in our seven-country sample to offer a real Reject button, and that button is more likely to work.
That is the clearest finding from the 5,559 French sites we analyzed in October 2026. France had the lowest rate of tracking after Reject of the seven countries, and shared the lowest rate of banners missing a first-layer Reject with Sweden. It's tempting to credit years of CNIL enforcement on exactly this point. Our data can't prove that, but the pattern fits.
France isn't ahead everywhere, though. On Google Consent Mode and Google Fonts it is average or worse.
This report is part of our study of small-business cookie consent across seven EU countries.
France vs. the seven-country average
French figures, with the seven-country average in brackets:
- Trackers before consent: 38.9% (42.9%)
- Ad pixels before consent: 25.2% (28.6%)
- Any pre-consent data transfer, including third-party services: 68.5% (70.9%)
- Banner shown: 31.8% (31.1%)
- Banners without a first-layer Reject button: 42.5% (51.7%), the lowest, tied with Sweden at 42.4%
- Tracking after Reject: 15.3% (21.1%), of 1,017 sites with a first-layer Reject button, the lowest of the seven countries
- Ad pixel after Reject: 11.1%
Our compliance score agrees. 29.5% of French sites landed in the green zone (no issues found), above the 26.3% average, and 22.4% landed in red, below the 25.6% average.
Before-consent numbers are only modestly better than average. The real difference shows up around refusal: whether a Reject button exists and whether it is respected.
The CNIL effect?
The CNIL, France's data protection authority, has focused on refusal for years. Its 2020 guidelines made clear that refusing should be as easy as accepting. In 2021 and 2022 it fined Google and Facebook for making refusal harder than acceptance. The message to anyone building a French website was simple: put Reject next to Accept.
It's plausible that this filtered down to small businesses. But a correlation in one scan is not proof of cause, and France's lead is in the area the CNIL emphasized, not across the board. We've also written about dark patterns in cookie banners.
Where France is not ahead
Consent Mode. Google has required Consent Mode v2 for EEA advertisers since March 2024. On 68.5% of the 1,973 French sites with Google tags it wasn't implemented, slightly worse than the 66.7% average. And 7.2% set consent to granted by default, above the 5.4% average, which means Google's tags behave as if the visitor had already agreed. See what Consent Mode v2 actually checks.
Google Fonts. 58.2% of French sites loaded Google Fonts from Google's servers. Fonts are a third-party service rather than a tracker, but they still send the visitor's IP address to Google before any choice. German courts ruled on this in 2022.
What loads, and what's in use
Before consent, the most common trackers were Google Analytics/GTM (1,461 sites), Google Ads (944) and the Meta Pixel (746), followed by Microsoft Clarity (141), Hotjar (83) and the Pinterest Tag (71).
The banner landscape has a distinctly French flavor. Alongside custom or unidentified banners (594 sites), Complianz (263), Cookie Notice (211), the Wix consent banner (117) and CookieYes legacy (103), we saw tarteaucitron, a French open-source tool (116), and Axeptio, a French company (69). This is a picture of what's in use, not a ranking: any of these tools can be configured well or badly, and configuration decides the outcome.
WordPress led the platforms with 2,474 sites, followed by Wix (359), Shopify (342) and PrestaShop (141), a platform of French origin. OVHcloud was the most common host, with 1,759 French sites, ahead of Cloudflare (954), o2switch (517) and IONOS (443).
How to check and fix your site
- Load your homepage in a private window without clicking. In the browser's Network tab, look for Google Analytics, Google Ads, Meta or Pinterest requests. If they appear, they loaded before consent.
- Click Reject and browse two more pages. A good Reject button is only half the job. The tags behind it must stop.
- Check your Consent Mode defaults. If they are set to granted, switch them to denied and let the banner update them.
- Self-host Google Fonts.
- Keep Reject on the first layer, as easy to reach as Accept.
Methodology
We took 37,814 small-business domains from the website links on public Instagram business profiles in seven EU countries. 23,367 loaded and were analyzed, 5,559 of them in France. On 24 October 2026 we loaded each homepage in a real Chromium browser with a clean profile from an EU IP address, with no interaction, and recorded every request and cookie. Where a first-layer Reject button existed, we clicked it and visited up to two more pages. The sample is not random and skews to consumer-facing small businesses. Server-side tracking is invisible to a browser, and this is not a legal assessment of any site.
Check your own site
Is your Reject button doing its job? Run a free scan and see what loads before consent and after Reject.
