Cornered by a series of formal notices from Cnil, online retailers are hitting a major obstacle : how to technically manage a consent withdrawal ? While the French PURR association has been denouncing a "ghost tracking" via an array of complaints, companies admit their helplessness in controlling outgoing personal data flows to external partners. A critical topic, as Brussels is preparing a future Digital Omnibus regulation.
On March 26, 2026, Cnil sent formal notice to two new retailers – Carrefour and Back Market – as well as EDF energy company to become compliant, as their current websites do not respect European obligations regarding cookie banners and online advertising, mind Retail has learned. The reason is the same as for the 40 complaints made since the start of January 2026 by the PURR association (For a Respect of GDPR). In response, Cnil has made 19 formal notices to date to AliExpress, Leroy Merlin, Ca
…Do you have information to share with us?
Article authors
Sophie Baqué
Chief Editor of mind Retail