Personal data occupies a central place in digital life, and the rules governing its collection evolve every year. In 2026, several decisions from the CNIL, the gradual implementation of new European regulations, and an increase in sanctions are reshaping the landscape for users. Measuring the gap between theoretical rights and their actual application helps to understand what has concretely changed.
CNIL Sanctions in 2026: Amounts and Reasons Compared
The fines imposed by the CNIL in recent months provide a direct insight into control priorities. Three recent decisions illustrate very different breaches but share a common point: the amounts at stake are increasing.
| Sanctioned Organization | Amount | Main Reason |
|---|---|---|
| Free Mobile and Free | 42 million euros | Insufficient security measures during a subscriber data leak |
| Extia | 300,000 euros | Failure to comply with the right to erasure in the recruitment process |
| Social network (targeted advertising) | Not disclosed in detail | Transmission of data to partners without valid consent |
The Free case is particularly revealing. The sanction does not concern a one-time negligence but the sensitive nature of the exposed banking data and the volume of affected individuals. The fact that the leak was detected several months after the events did not mitigate the decision.
You can find information on blognetnews.com detailing the obligations of websites regarding the processing of personal data.
Right to Erasure: A Persistent Gap Between Theory and Practice
The GDPR grants each individual the right to request the deletion of their data. In theory, a simple email is enough. In practice, the sanction against Extia shows that requesting deletion does not guarantee its implementation.
In the recruitment sector, CVs, cover letters, and personal contact details remain stored well beyond the necessary duration. An unsuccessful candidate may be unaware that their information continues to circulate in internal databases months or even years after their application.
What You Can Do Practically
- Send your deletion request in writing (email or letter) citing Article 17 of the GDPR, which obliges the organization to respond within one month
- Keep a copy of your request and the response received: in case of silence or unjustified refusal, these elements constitute proof to approach the CNIL
- Regularly check accounts created on recruitment platforms or e-commerce sites, and delete those you no longer use
The problem extends beyond recruitment. Any organization that retains data beyond its initial purpose is exposed to a sanction. The challenge remains to know which companies still hold your information.
Fake Assistance Offers After a Data Leak
A phenomenon documented by the CNIL in June 2026 deserves particular attention. After a data breach, victims now receive fraudulent messages offering help to recover their information. These messages use real data stolen during the leak (identity, address, IBAN) to appear credible.
Some scammers even go so far as to impersonate the CNIL’s phone number. The sophistication of these attempts makes it particularly difficult to distinguish between a legitimate message and a scam.
Protective Reflexes Against These Solicitations
The CNIL never directly contacts victims to offer paid assistance. If you receive a call or SMS after a leak, do not respond, do not click on any links, and do not provide any additional documentation.
The rule is simple: any unsolicited solicitation after a breach is suspicious. In case of doubt, contact the CNIL only through its official website.
Consent to Trackers and Regulatory Convergence in 2026
The question of consent to cookies and trackers remains an active area of control. The CNIL has launched a consultation on proof of consent, indicating that the current practices of many sites do not meet compliance requirements.
At the same time, the implementation of the European AI Act creates a new layer of obligations for automated processing. An artificial intelligence system that uses personal data must simultaneously comply with the GDPR and the specific rules for AI. The CNIL has also published practical guides (available in English) to assist developers in achieving this dual compliance.
The GDPR no longer operates in isolation. The convergence with the AI Act, the Data Act, and the Digital Services Act (DSA) means that the same data processing may fall under multiple texts. For users, this translates into potentially strengthened rights, but also increased complexity in identifying the competent interlocutor in case of issues.
- The DSA imposes transparency obligations on large platforms regarding their recommendation algorithms, directly affecting advertising profiling
- The AI Act classifies certain automated systems as “high risk,” reinforcing documentation and human oversight obligations
- The Data Act regulates data sharing between businesses, with implications for the portability of personal information
The proliferation of texts does not change the basic reflex: verify what you consent to, exercise your rights in writing, and never consider that an online registration is trivial. Recent sanctions show that authorities are shifting from education to enforcement, including against large players. The gap between theoretical rights and their application is narrowing, but it still falls to each individual to actively assert their rights.
