GDPR and consent (analytics)
GDPR requires obtaining explicit user consent before placing tracking cookies or sending personal data to third-party analytics services. In France, the CNIL specifies the conditions for valid consent through its cookie doctrine, which applies to all sites targeting French users.
In practice
Valid consent must be free (refusing as easy as accepting), informed (list of purposes and third parties), and specific (separate consent per purpose). Pre-checked boxes or 'accept' buttons without a visible refusal option are unlawful. In practice, achieving an acceptance rate above 70% requires a carefully designed consent UX — Axeptio and Didomi publish sector benchmarks.