CookieDetox
Audit
FR | EN
Sanctions & Amendes 2026-08-09

Sirdata CMP: CNIL Compliance Audit & Technical Optimization

CD

Par Cellule Investigation CookieDetox

Expertise Juridique & Conformité

🔗
T

Key Takeaways

A CNIL compliance audit of a Sirdata CMP involves a rigorous technical verification of TCF 2.2 implementation, blocking mechanisms, consent granularity, and proof of collection. It relies on tools like GTM and DevTools to ensure adherence to regulatory requirements and avoid penalties.

Audit & Compliance : Sirdata CMP (EN)

Understanding the CNIL Regulatory Framework and the Role of CMPs

In today's digital ecosystem, consent management has become a cornerstone of user trust and legal compliance. The French Data Protection Authority (CNIL), as a supervisory authority, imposes strict requirements for collecting and processing consent, particularly for Cookies and other trackers. A Consent Management Platform (CMP) like Sirdata is an essential tool for navigating this complex landscape. However, integrating a CMP does not ipso facto guarantee compliance. A rigorous technical and legal audit is essential to ensure that Sirdata's implementation meets the highest standards of the CNIL and GDPR.

Key CNIL Requirements for Consent

The CNIL, in line with the GDPR, structures its requirements around four fundamental pillars for valid consent:

  1. Free: The user must have a genuine choice, without constraint or pressure. Cookie walls, complicated refusal options, or pre-checked boxes are prohibited.
  2. Specific: Consent must be given for precise and explicit purposes. Global and undifferentiated consent is insufficient.
  3. Informed: Information must be clear, understandable, and easily accessible, detailing the identity of data controllers, the purposes, and the list of partners.
  4. Unambiguous: Consent must result from a clear affirmative action (e.g., clicking "Accept"). Silence or inactivity does not constitute consent.

Furthermore, the CNIL emphasizes the ability to prove consent (logging), the ease of withdrawing consent at any time, and the granularity of choices offered to the user, allowing them to accept or refuse by purpose and by partner.

The TCF 2.2 Standard and its Implementation by Sirdata

The Transparency and Consent Framework (TCF) by IAB Europe is a technical standard designed to help publishers, advertisers, and technology providers comply with the GDPR and the ePrivacy Directive ↗. TCF version 2.2, updated to meet the requirements of data protection authorities, is crucial. Sirdata, as a TCF-certified CMP, must implement this standard impeccably. This involves managing purposes, special features, vendors, and consents/legitimate interests via the consent string (TC String). The audit must verify that the Sirdata CMP correctly generates and transmits this TC String to partners, and that user choices are accurately reflected in this string.

Sirdata CMP Technical Audit Methodology

A technical audit of a Sirdata CMP is a two-phase process: pre-deployment and post-deployment. Each phase uses specific tools to validate compliance.

Pre-Deployment Audit: Configuration and GTM Integration

Even before going live, the configuration of Sirdata and its integration via a Tag Management System (TMS) like Google Tag Manager (GTM) are critical. The goal is to ensure that the CMP is correctly loaded, that third-party tags are blocked by default, and that consent events are properly pushed into the dataLayer.

Key Steps:

  1. Sirdata script integration: The CMP script must be the first to load on the page, before any other script that might place trackers.
  2. GTM Configuration: Use dataLayer variables to retrieve consent status and custom triggers to enable/disable tags.
  3. Default Blocking: Verify that all non-essential tags are blocked until the user has given explicit consent.

Example GTM Configuration for Sirdata (excerpt):

// Sirdata script to be placed at the top of the <head>
<script type="text/javascript">
    (function() {
        var s = document.createElement('script');
        s.setAttribute('type', 'text/javascript');
        s.setAttribute('src', '//cmp.sirdata.com/sdcmp.js');
        s.setAttribute('async', 'true');
        s.setAttribute('data-cmp-partner', 'YOUR_PARTNER_ID'); // Replace with your ID
        s.setAttribute('data-cmp-host', 'https://cmp.sirdata.com');
        s.setAttribute('data-cmp-locale', 'fr');
        s.setAttribute('data-cmp-purpose-text', 'true');
        document.head.appendChild(s);
    })();
</script>

// In GTM, a custom trigger of type 'Custom Event' for 'sd_consent_ready'
// A variable of type 'Data Layer Variable' for 'sd_consent_status' or 'tcData.vendor.consents'
// Conditional tags based on these variables for triggering third-party tags.

Post-Deployment Audit: Behavior and Storage Analysis

Once the CMP is live, the audit focuses on its actual behavior and how it manages consent data. Browser developer tools (DevTools) are essential here.

Audit Steps with DevTools (Chrome/Firefox):

  1. Network Tab:
    • Reload the page in incognito mode.
    • Verify that no calls to third-party domains (Google Analytics, Facebook, etc.) are made before interacting with the CMP.
    • After refusing consent, ensure these calls still do not occur.
    • After accepting, verify that the calls are initiated.
  2. Application Tab (or Storage):
    • Cookies: Examine the cookies placed. The Sirdata consent cookie (e.g., sd_cmp, euconsent-v2) must be present and reflect user choices. No other non-essential cookies should be present before consent.
    • Local Storage / Session Storage: Verify the presence of the TC String (__tcfapi_tcdata) and other consent data.
  3. Console Tab:
    • Query the TCF API: __tcfapi('getTCData', 2, function(tcData, success) { console.log(tcData); }); to check the structure and content of the TC String.
    • Check for error or warning messages related to the CMP.
  4. DOM Inspection:
    • Verify that third-party scripts are properly blocked via type="text/plain" data-cmp-vendor="..." attributes or similar mechanisms before consent.

Example of DOM Blocking (before consent):

<!-- Google Analytics script blocked by Sirdata -->
<script type="text/plain" data-cmp-vendor="google" data-cmp-purpose="analytics">
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
    ga('create', 'UA-XXXXX-Y', 'auto');
    ga('send', 'pageview');
</script>

Example of Consent Receipt Structure (JSON):

{
  "consentId": "SIRDATA-CMP-20260809-XYZABC",
  "timestamp": "2026-08-09T10:30:00Z",
  "version": "TCF_V2.2",
  "publisher": {
    "id": "YOUR_PUBLISHER_ID",
    "purposes": {
      "1": true, "2": false, "3": true, "4": false, "5": true, "6": true, "7": true, "8": true, "9": true, "10": true
    },
    "specialFeatures": {
      "1": true, "2": false
    }
  },
  "vendors": [
    {
      "id": "google",
      "consentedPurposes": [1, 3, 7, 8, 9, 10],
      "legitimateInterestPurposes": []
    },
    {
      "id": "facebook",
      "consentedPurposes": [1, 3, 7, 8, 9, 10],
      "legitimateInterestPurposes": []
    }
  ],
  "userChoices": {
    "allAccepted": false,
    "allRejected": false,
    "granularChoices": {
      "purpose1": "accepted",
      "purpose2": "rejected",
      "vendorGoogle": "accepted",
      "vendorFacebook": "accepted"
    }
  },
  "geo": {
    "country": "FR",
    "region": "IDF"
  }
}

Compliance Verification: Case Studies and CNIL Sanctions

Analyzing CNIL decisions provides valuable lessons on errors to avoid and points of vigilance. Recent sanctions highlight the importance of compliance that is not only technical but also ergonomic and ethical.

Analysis of CNIL Decisions: Google, Amazon, Meta, Criteo

Here is a comparative table of emblematic CNIL sanctions, highlighting recurring reasons for non-compliance:

Scroll horizontally ↔
Entity Sanction Date Fine Amount Main Reasons for Sanction
Google LLC & Google Ireland Ltd. December 2020 / January 2022 €100 M / €150 M
  • Absence of a mechanism allowing cookies to be refused as easily as they are accepted.
  • Insufficient information on the purposes of cookies and their lifespan.
  • Placement of cookies without prior consent.
Amazon Europe Core December 2020 €35 M
  • Placement of cookies without prior consent.
  • Insufficient information on the purposes of cookies.
Meta Platforms Ireland Limited (Facebook, Instagram, WhatsApp) January 2022 €60 M
  • Inability for users to refuse cookies as easily as they accept them.
  • Use of dark patterns to encourage acceptance.
Criteo June 2023 €40 M
  • Failure to comply with the obligation to collect individuals' consent.
  • Failure to comply with the obligation of information and transparency.
  • Failure to respect the right of access and withdrawal of consent.

Common Pitfalls and How Sirdata Addresses Them (or Not)

CNIL sanctions highlight recurring pitfalls that CMPs must absolutely avoid:

  • Dark Patterns: Interfaces designed to manipulate the user towards a specific choice (e.g., "Accept" button more visible than "Refuse"). Sirdata offers banner configurations that can be optimized for compliance, but the ultimate responsibility lies with the publisher not to implement dark patterns.
  • Cookie Walls: Blocking access to content if consent is not given. The CNIL considers them illegal except for very rare and justified exceptions. Sirdata, as a CMP, should not be configured to impose a cookie wall.
  • Lack of Granularity: Not offering the possibility to consent by purpose or by partner. Sirdata, via TCF 2.2, allows for fine granularity, but the user interface must make it accessible and understandable.
  • Difficulty of Withdrawal: The withdrawal mechanism must be as simple as the acceptance mechanism. Sirdata must provide an easily accessible link or button on all pages to modify or withdraw consent.
  • Proof of Consent: The absence of logging or timestamped proof of consent is a serious breach. Sirdata offers logging functionalities, but their correct implementation and retention are essential.

An audit must therefore not only verify the technical aspects of Sirdata but also its UX/UI integration to ensure it does not create non-compliant biases.

Optimization and Maintenance: Ensuring Sustainable Compliance

Compliance is not a static state but a continuous process. Once the initial audit is passed, maintenance and optimization are crucial to ensure sustainable compliance.

Management of Consent Proofs and Logging

The CNIL requires data controllers to be able to prove that they have collected valid consent. This involves robust logging of consent interactions.

  • Timestamping: Every consent action (acceptance, refusal, modification, withdrawal) must be precisely timestamped.
  • Consent Details: Record the purposes and partners for which consent was given or refused.
  • Unique Identifier: Associate each consent with a unique user identifier (without this identifier being directly nominative, but allowing the consent to be retrieved).
  • Retention: Proofs of consent must be retained for a reasonable period (generally 5 years in France) and be accessible in case of an audit.

Sirdata offers solutions for consent logging, often via APIs or exports. It is imperative to ensure that this data is correctly collected, securely stored, and easily retrievable.

Continuous Monitoring and Responsiveness to Regulatory Changes

The regulatory landscape is constantly evolving. New CNIL directives, TCF updates, or court decisions can impact the validity of your CMP.

  • Regular Audits: Implement periodic technical and legal audits (quarterly or semi-annually) to ensure the CMP remains compliant.
  • Regulatory Watch: Actively monitor publications from the CNIL, the EDPB (European Data Protection Board), and IAB Europe.
  • Automated Tests: Use automated compliance scanning tools to quickly detect unauthorized cookie placements or unexpected changes.
  • CMP Updates: Ensure that Sirdata is always up-to-date with the latest TCF versions and CNIL recommendations.
  • Team Training: Raise awareness and train marketing, technical, and legal teams on compliance issues and best practices for consent management.

By adopting a proactive approach and integrating compliance as a continuous process, organizations can not only avoid sanctions but also strengthen user trust, an invaluable asset in the digital economy.

§

Official Legal Sources & Authoritative Decisions

Primary statutory texts, official DPA rulings, and European court judgments referenced in this analysis.

Updated 2026-08-09
Share this article:

FAQ : Sirdata CMP: CNIL Compliance Audit & Technica

What does the CNIL require from a CMP like Sirdata?

The CNIL requires a CMP to ensure free, specific, informed, and unambiguous consent. This implies default blocking of trackers, granularity of choices by purpose and partner, clear information, withdrawal of consent as easy as its acceptance, and the ability to prove each collected consent.

How to technically test the compliance of a Sirdata CMP?

Technical compliance is tested via browser DevTools (Network, Application, Console tabs) to verify script blocking before consent, the presence and content of cookies and the TC String, and the absence of unauthorized tracker placement. GTM integration must also be audited to ensure proper tag triggering.

What are the risks of CNIL non-compliance for a CMP?

Risks include substantial administrative fines (up to 4% of global turnover or 20 million euros), injunctions to comply, damage to the company's reputation, and loss of user trust. The cases of Google, Amazon, Meta, and Criteo are concrete examples.

Is Sirdata inherently GDPR/CNIL compliant?

Sirdata is a TCF 2.2 certified CMP, designed to facilitate compliance. However, its effective compliance depends entirely on its implementation and configuration by the publisher. Poor integration, dark patterns, or a lack of granularity can render a CMP non-compliant, even if the underlying tool is robust.