Precedent corpus / CNIL (France)
AMERICAN EXPRESS CARTE FRANCE
CNIL (France) case SAN-2025-011, decided . EUR 1.5M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
What the regulator decided
American Express recorded the content of customer-service calls without demonstrating necessity for the processing, breaching the data-minimisation principle in Article 5(1)(c) GDPR; and the cookie-consent-withdrawal mechanism on its website did not effectively stop the reading of previously-set cookies, breaching the consent-withdrawal limb of Article 82 of the French Data Protection Act.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827ConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Financial-services precedent. Cite when the scanner narrative needs the principle that withdrawal of consent must stop downstream reads (not only future writes), alongside SAN-2024-019 (Orange) and SAN-2025-010 (Condé Nast).
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-cnil-san-2025-011,
author = {{ConsentMark}},
year = {2025},
title = {CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE},
howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2025-011}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, November 27). CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE. Methodology v7.8.1. https://www.consentmark.com/precedent/cnil-san-2025-011[CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2025-011)CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE - ConsentMark, 2025-11-27, methodology v7.8.1, https://www.consentmark.com/precedent/cnil-san-2025-011