CNIL - Commission Nationale Informatique et Libertés

American Express Carte France Fined €1.5 Million for Cookie Violations The French data protection authority, CNIL, has fined American Express Carte France, a subsidiary of American Express, €1.5 million for violating cookie regulations. The penalty was issued on November 27, 2025, following inspections in January 2023 that revealed the company placed cookies on users' devices without consent, ignored users' refusal to accept cookies, and continued reading cookies after consent was withdrawn. Despite eventually complying during the procedure, the company's actions breached Article 82 of the French Data Protection Act. The fine reflects the well-known nature of cookie regulations and their widespread dissemination by CNIL.