American Express Carte France – €1,500,000 Fine (France, 2025)

€1,500,000Commission Nationale de l'Informatique et des Libertés27 November 2025France
final
ePrivacy
Fine

American Express Carte France was fined €1.5 million for not following data protection rules regarding cookies and call recordings. The company placed cookies on users' devices without their consent and failed to provide clear information. This case shows that companies must be transparent about how they collect and use personal data.

What happened

American Express Carte France was fined for placing cookies without user consent and for unclear cookie information.

Who was affected

Users of American Express Carte France who were affected by the improper cookie practices.

What the authority found

The French data protection authority found that the company violated data minimization principles and failed to obtain consent for cookie usage.

Why this matters

This ruling underscores the importance of obtaining user consent for cookies and being clear about data collection practices. Companies should review their cookie policies to avoid similar penalties.

GDPR Articles Cited

AI-verified

Art. 5(1)(c) GDPR
View original scraped data
Art. 5(1)(c) GDPR

Original data from scraper before AI verification against source document.

National Law Articles

AI-identified

Article 82 French Data Protection Act
Source verified 10 March 2026
articles corrected
national law identified
verified correct
Full Legal Summary
Detailed

The investigation primarily focused on data minimization and recording of telephone calls, with only a tangential mention of cookie placement.

Violations (4)

No Reject Button
critical

Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.

Art. 7 GDPR

Cookies Placed Before Consent
critical

Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.

Art. 6(1) GDPR

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Unclear Cookie Information
high

The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.

Art. 12, 13 GDPR

Related Enforcement Actions (0)

No other enforcement actions found for American Express Carte France in FR

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

27 November 2025

Authority

Commission Nationale de l'Informatique et des Libertés

Fine Amount

€1,500,000

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified
Cookie relevance: 20%

Cite as: Cookie Fines. American Express Carte France - France (2025). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: