Cookie consent gets tested in one browser. The CNIL recommendation talks about every device.

What changed, and when

The CNIL (France's data-protection authority) adopted délibération (decision) n° 2025-131 of 18 December 2025 (opens in new tab), amending its recommendation n° 2020-092 on cookies and other trackers to insert an article on « consentement multi-terminaux » (multi-device consent). The consolidated text was published on 16 January 2026. Its scope is authenticated environments — websites, mobile apps, connected devices: the situations where the user is recognised by an account rather than by a single browser.

What the CNIL describes

In an authenticated environment, the modalities described are these. The user's choices carry identical scope across the different devices signed in to their account. Refusing and withdrawing consent are as simple there as on the first device. The user is told that their choice applies to all of their devices, with a temporary message when they arrive from a new device. Where preferences diverge, two methods are admitted — priority to the last choice expressed before signing in, or priority to the preferences recorded on the account — the chosen method having to be applied, in the CNIL's own words, « d'une façon qui soit claire et loyale vis-à-vis de l'utilisateur » (in a way that is clear and fair to the user).

Why the usual audit method does not see it

This is an observable property of an authenticated session, and it takes three moves to observe: sign in on one device, refuse, sign in on a second with the same account, and watch what leaves before any interaction. The usual audit method — a private browsing window, one browser, one device — does not test it. It cannot: the behaviour described exists only between two devices bound by an account, and a private window is by construction a device with no account.

Three observations, not three criteria

These are recorded as risk observations, on a named date, not as binary gaps: a CNIL recommendation sets out practical modalities and is not presented as prescriptive. Three questions arise. Does a refusal or a withdrawal recorded on one signed-in device carry, with the same scope, to the other devices signed in to the same account? Is the user told, on a new device, that the choice recorded on the account applies there? Where a choice expressed before signing in and a preference recorded on the account diverge, which one prevails, and is that rule applied consistently? Referential: CNIL délibération n° 2025-131, the article inserted into recommendation n° 2020-092.

What this produces is a dated record against a named text, not a characterisation. Legal characterisation is for your counsel.