CNIL fines in 2025: without the two record fines, the average falls to €146,000

A chat that collects a name, an email address or a phone number collects personal data. The GDPR applies, and in France the CNIL enforces it.

What the 2025 figures say

In 2025, the CNIL carried out 323 inspections and issued 259 decisions, including 83 sanctions totalling €486,839,500. Two fines of €325 million and €150 million account for most of it. Without them, the other 81 sanctions add up to about €11.8 million, or €146,167 on average.

The rules to apply to a chat

• Ask only for what you need: a name and one way to get back in touch are enough for a call back.
• Inform visitors, at the moment you collect their details, how they will be used and what their rights are, with a link to your privacy policy.
• Set a retention period for conversations and for leads that do not become clients.
• Check trackers: if the tool sets non-essential cookies, consent rules apply.
• Put a contract in place with your provider: it processes data on your behalf, which requires an agreement that meets Article 28 of the GDPR.

Why the average matters more than the record

Fines of several hundred million euros target very large companies. For a small business, the risk shows in ordinary sanctions, and above all in visitor trust: a form that asks for too much information drives people away before any legal question arises.