AMERICAN EXPRESS CARTE FRANCE

CNIL (France) case SAN-2025-011, decided 2025-11-27. EUR 1,500,000.

What the regulator decided

American Express recorded the content of customer-service calls without demonstrating necessity for the processing, breaching the data-minimisation principle in Article 5(1)(c) GDPR; and the cookie-consent-withdrawal mechanism on its website did not effectively stop the reading of previously-set cookies, breaching the consent-withdrawal limb of Article 82 of the French Data Protection Act.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Financial-services precedent. Cite when the scanner narrative needs the principle that withdrawal of consent must stop downstream reads (not only future writes), alongside SAN-2024-019 (Orange) and SAN-2025-010 (Condé Nast).

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-cnil-san-2025-011,
  author       = {{ConsentMark}},
  year         = {2025},
  title        = {CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE},
  howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2025-011}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2025, November 27). CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE. Methodology v1.3. https://www.consentmark.com/precedent/cnil-san-2025-011

Markdown

[CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2025-011)

Plain text

CNIL (France) SAN-2025-011 - AMERICAN EXPRESS CARTE FRANCE - ConsentMark, 2025-11-27, methodology v1.3, https://www.consentmark.com/precedent/cnil-san-2025-011