LES PUBLICATIONS CONDE NAST – €750,000 Fine (France, 2025)

The company LES PUBLICATIONS CONDE NAST (the “controller”) publishes printed and online magazines, including the magazine Vanity Fair. Vanityfair.fr received more than 6 million visitors in France between June and October 2023. In December 2019, a data subject represented by noyb filed a complaint with the French DPA concerning the cookies placed on the devices of users visiting the “vanityfair.fr” website. After several investigations and discussions with the DPA, the controller received, in September 2021, an order to obtain user consent before placing optional cookies, and the proceedings were closed in July 2022. Following later complaints by the data subject in July and November 2023, and a request for a new investigation by the rapporteur in 2025, the DPA carried out further online investigations on the “vanityfair.fr” website, to check its compliance with the GDPR and the French Data Protection Act. The DPA first determined the controllership and considered that the company acted as a controller pursuant Article 4(7) GDPR regarding the cookies placed and read on the terminal of users of the https://www.vanityfair.fr website. The DPA recalled that the rules regarding cookies and other trackers on terminal equipment used in the European Union are set out in Article 5(3) of e-Privacy Directive 2002/58/EC and were transposed into French law in Article 82 since the revision of the Data Protection Act in 2018. The DPA sanctioned several cookies practices by the controller that were contrary to Article 82 of the French Data Protection Act. Under this article, the provider was required to ask consent of data subjects if it read/wrote information on the user’s device. There are, however, two exceptions to this consent requirement. No consent was required if the sole purpose of the identifier was to facilitate communication by electronic means or when the identifier was strictly necessary for the provision of an online communication service at the user's request. If an identifier had multiple purposes, the provider could only use the identifier for advertising when it had obtained prior consent from the data subject for this specific purpose. Failure to obtain users consent before placing cookies The DPA found the presence of a cookie not strictly necessary for providing the online service and not solely intended to enable or facilitate electronic communication. This cookie, subject to consent, was placed on the devices of users visiting the "vanityfair.fr" website as soon as they arrived on the site, even before they interacted with the information banner to express a choice. Lack of clarity in the information provided to users The DPA found that some cookies appeared as ‘strictly necessary’ cookies and therefore as exempt from the obligation to obtain users' consent, without information being made available to users about their purposes. Ineffective mechanisms for refusing and withdrawing consent The DPA found that when users visiting the “vanityfair.fr” website clicked on the “Refuse all” button placed in the banner, or when they decided to withdraw their consent to the installation of trackers on their device, new cookies subject to consent were placed nonetheless, and other cookies that were already present continued to be read. The DPA imposed an administrative fine of €750,000 for the infringement of Article 82 of the French Data Protection Act, taking into consideration the number of people affected, the prior compliance order already issued against the controller, and the controller’s financial capacity.