The CNIL

In France, the CNIL (the French data protection authority) accepts that certain audience measurement trackers may be placed without the visitor’s consent, under strict conditions. Its guidelines and its recommendation on “cookies and other trackers” (2020), and its page dedicated to audience measurement solutions, describe them. eodia analytics is designed to make it possible to stay within this framework, in cookieless mode as well as in measurement cookie mode.

What follows is not legal advice

Meeting the exemption also depends on your use: what you measure, what you put in event properties, who you share the results with. Have your configuration and your texts validated by your data protection officer (DPO), and refer to the CNIL’s publications, which are authoritative.

The conditions, and how they are met

Condition	Cookieless	Measurement cookie
A purpose strictly limited to audience measurement, for the site publisher alone	no viewing outside your eodia insights instance; no sharing with a third party	same
Anonymous data, not cross-referenced with other processing	daily salt destroyed the next day; IP address never stored; country only	random identifier, unrelated to the IP address or the identity
No tracking from one site to another	the site is part of the hash	first-party cookie, set on the site’s domain only
Trackers limited to 13 months	no tracker; only optOut() sets a marker, which is used to respect the objection	13 months at most, expiry set at creation and never extended
Data kept for 25 months at most	retention period capped at 25 months, applied every night	same
Informing the visitor, and their right to object	optOut(), Global Privacy Control signal, information text below	same; optOut() deletes the cookie

What falls outside

Whatever the mode, these uses no longer fall under the exemption and require their own legal basis:

• signed-in visitors: linking the measurement to a customer identifier turns it into personal data. The feature is disabled by default, site by site;
• sharing the results with a third party who would use them for its own purposes;
• event properties that would contain personal data (e-mail address, name, customer number): do not put any.

The With consent mode does not depend on the exemption: it lets your consent management platform decide. The site’s Settings screen recalls what each mode implies at the time of the choice.

Subdomains

Sharing the measurement cookie between subdomains of the same publisher (blog. and boutique.) is not clearly settled by the CNIL: have it confirmed by your DPO before enabling it.

The information text

The exemption does not remove the obligation to inform visitors, nor to let them object. A text to adapt, for your privacy policy (a French site addresses its French visitors in French; the English text below is a template to adapt to your site and your audience):

Audience measurement

To understand how our site is used and to improve it, we measure its traffic with eodia analytics, hosted by us [or: by our provider, name]. This measurement produces anonymous statistics, reserved for our own use: it is not used to track you on other sites or to identify you, and your IP address is not kept.

[Cookieless mode:] No cookie is placed on your device for this measurement.

[Measurement cookie mode:] A cookie named _eoa, which contains a random identifier, is placed to recognize your browser from one visit to the next. It expires 13 months after it is placed and is never extended.

The data is kept for 25 months at most. You can object to this measurement at any time: [Stop measuring my visit]. Your browser can also prevent it by sending the Global Privacy Control signal.

Adapt the brackets: the site’s mode, the cookie lifetime and the retention period set in its Settings, the host.

The opt-out link

The “Stop measuring my visit” link calls EodiaAnalytics.optOut():

<button type="button" id="eodia-optout">Stop measuring my visit</button>
<script>
  document.getElementById('eodia-optout').addEventListener('click', function () {
    window.EodiaAnalytics && EodiaAnalytics.optOut();
    this.textContent = 'Audience measurement is disabled in this browser.';
    this.disabled = true;
  });
</script>

The objection is stored in the browser (localStorage), deletes the measurement cookie and stops all sending for this site. EodiaAnalytics.optIn() lifts it, for a “Re-enable” button.

In summary

1. Choose the site’s mode: cookieless, or measurement cookie (13 months at most).
2. Leave signed-in visitors disabled, unless you have a separate legal basis.
3. Set the retention period (25 months at most).
4. Publish the information text and the opt-out link.
5. Do not share the results with anyone who would use them for their own purposes.
6. Have the whole setup reviewed by your DPO.