Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte €476.5m 58 % · 3 cases
- Autorité de la concurrence €212.4m 26 % · 4 cases
- Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris €50.9m 6 % · 5 cases
- Commission nationale de l'informatique et des libertés (CNIL) €50m 6 % · 6 cases
- Parquet national financier (PNF); Validierung durch das Tribunal judiciaire de Paris €16.1m 2 % · 1 case
- Conseil d'État €15m 2 % · 1 case
- Autorité des marchés financiers (AMF), Commission des sanctions €2.94m 0 % · 3 cases
- Tribunal judiciaire de Paris (34. Kammer) — 0 % · 2 cases
What for?
by area of lawAll areas of law
Who?
by sectorAll sectors
- Media and online platforms €325.8m 40 % · 2 cases
- Energy and utilities €187.5m 23 % · 3 cases
- Retail and e-commerce €159.3m 19 % · 3 cases
- Telecoms, IT and software €60.7m 7 % · 5 cases
- Construction and real estate €29.8m 4 % · 2 cases
- Other €18.4m 2 % · 1 case
- Transport, logistics and shipping €15m 2 % · 1 case
- Food and agriculture €12.7m 2 % · 1 case
- Healthcare €6.93m 1 % · 3 cases
- Public sector €5m 1 % · 1 case
- 3 more€2.86m
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 1 | €420,000 |
| Q4 2024 | 1 | €40,000 |
| Q1 2025 | 2 | €1.36m |
| Q2 2025 | 2 | €17.8m |
| Q3 2025 | 3 | €493.4m |
| Q4 2025 | 8 | €218.7m |
| Q1 2026 | 5 | €79m |
| Q2 2026 | 2 | €12.7m |
| Q3 2026 | 1 | €500,000 |
25 cases
21 Jul 2026 Hôpital Privé de la LoireHôpital Privé de la Loire: 500,000 EUR after data exfiltration affecting over 520,000 patients €500,000
In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).
External access to patient records belongs behind multi-factor authentication and continuous monitoring for unusual access.
Access security and attack detection in hospitals
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 32, Art. 34
- Action
- Fine
- Status of proceedings
- final
- Sector
- Healthcare
- Published
- 3 Sep 2026
- Sanction : amende de 500 000 euros à l'encontre de l'Hôpital Privé de la Loire Press release of an authority
- Délibération SAN-2026-009 du 21 juillet 2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
25 Jun 2026 TotalEnergiesParis Judicial Court: TotalEnergies must include Scope 3 emissions in vigilance plan Order
In an action brought by Notre Affaire à Tous, Sherpa, ZEA, France Nature Environnement and the City of Paris, the Paris Judicial Court (Tribunal judiciaire de Paris, 34th chamber) ruled that climate risks fall under the French duty of vigilance law and that Scope 3 emissions are part of the oil and gas group's activities. The vigilance plan without Scope 3 is incomplete, the court held; TotalEnergies must supplement it within six months, with provisional enforceability, and implementation will be reviewed by the court in January 2027.
Risk analyses under due diligence laws must also cover the climate impact of the products sold (Scope 3).
- Authority / court
- Tribunal judiciaire de Paris (34. Kammer)
- Area of law
- Supply chain and human rights · Supply chain due diligence
- Legal basis
- Art. L.225-102-1 und L.225-102-2 Code de commerce (Loi n° 2017-399, devoir de vigilance); Art. 1252 Code civil
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Energy and utilities
- Employees
- 10,000 or more
- Published
- 25 Jun 2026
- Communiqué de presse – Jugement du 25 juin 2026, 34ème chambre Court press release
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Apr 2026 Synadis Bio, Greenweez (mit Carrefour SA), ITM Entreprises (mit Les Mousquetaires), Les Comptoirs de la BioFrance: 12.67 million EUR over allocation of distribution channels for organic food €12.7m
Through the association Synadis Bio, market participants ensured for more than seven years that organic brands were not sold simultaneously in specialist organic shops and in conventional supermarkets, in order to prevent price comparisons (decision 26-D-05). Fines: Synadis Bio 10 million EUR, Greenweez/Carrefour 1.85 million EUR, ITM 740,000 EUR, Les Comptoirs de la Bio 80,000 EUR.
Association decisions that tie members to particular distribution channels amount to market sharing – even if they are justified as a quality or positioning policy.
Association rules to foreclose distribution channels
- Authority / court
- Autorité de la concurrence
- Area of law
- Competition law · Cartels and collusion
- Legal basis
- Art. L.420-1 Code de commerce, Art. 101 Abs. 1 AEUV; Bußgeldbemessung nach Art. L.464-2 Code de commerce
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Food and agriculture
- Published
- 16 Apr 2026
- L'Autorité de la concurrence sanctionne à hauteur de 12,67 millions d'euros (Entscheidung 26-D-05) Press release of an authority
- Décision 26-D-05 (version publique) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Mar 2026 Colas Rail Asia Sdn Bhd (Colas-Gruppe)Colas Rail Asia: CJIP of 29.7 million EUR over bribery in metro contracts in Malaysia €29.7m
The Malaysian subsidiary of Colas Rail paid large, undocumented sums via intermediaries in connection with public contracts for urban rail lines in Kuala Lumpur (Kelana Jaya extension, MRT2). Following an internal investigation, Colas Rail self-reported the matter in 2017; the CJIP (Convention judiciaire d'intérêt public, a French deferred prosecution agreement) provides for a public interest fine of 29,745,974 EUR and a three-year compliance programme monitored by the French Anti-Corruption Agency (AFA) (costs of up to 1.9 million EUR).
Undocumented payments to intermediaries on foreign projects must be stopped early by the finance and compliance functions – self-reporting after an internal investigation is rewarded.
Intermediaries and consultants in public tenders
- Authority / court
- Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris
- Area of law
- Bribery and corruption · Bribery of public officials
- Legal basis
- Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger
- Action
- Fine
- Status of proceedings
- final
- Sector
- Construction and real estate
- Employees
- 10,000 or more
- Culpability
- intentional
- Mitigating circumstances
- Self-report (criminal complaint filed by Colas Rail on 31 May 2017) following an internal forensic investigation.
- Liability of senior managers
- The CJIP does not address the criminal liability of natural persons.
- Published
- 19 Mar 2026
- Communiqué de presse du procureur de la République financier – CJIP COLAS RAIL ASIA Press release of an authority
- Convention judiciaire d'intérêt public – COLAS RAIL ASIA (17.03.2026) Decision of an authority
- Ministère de la Justice: Conventions judiciaires d'intérêt public (Verzeichnis) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Mar 2026 Balt USA LLC (Balt-Gruppe)Balt USA: CJIP in France over payments to a hospital physician €1.77m
In parallel with the US declination, the PNF concluded a CJIP with the US subsidiary of the French medical technology manufacturer for 1,765,493 EUR (after crediting the US disgorgement) and a three-year AFA compliance programme. The case arose from Balt SAS's voluntary self-disclosure of 22 May 2023 concerning offences committed by a former manager of the acquired company Blockade Medical.
Acquisitions require anti-corruption due diligence on the target company – otherwise legacy misconduct by its management becomes a group risk.
Benefits to hospital physicians, integration of acquired companies
- Authority / court
- Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris
- Area of law
- Bribery and corruption · Bribery of public officials
- Legal basis
- Art. 41-1-2 Code de procédure pénale (CJIP); aktive und passive Bestechung von Amtsträgern
- Action
- Fine
- Status of proceedings
- final
- Sector
- Healthcare
- Employees
- 250 to 999
- Culpability
- intentional
- Mitigating circumstances
- Voluntary self-disclosure to the PNF and the DOJ; coordinated resolution with crediting.
- Liability of senior managers
- The CJIP does not address the criminal liability of natural persons.
- Published
- 19 Mar 2026
- Communiqué de presse du procureur de la République financier – CJIP BALT USA Press release of an authority
- Ministère de la Justice – Conventions judiciaires d'intérêt public (Liste) Official register or notice
- CJIP Société BALT USA LLC (17.03.2026) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
18 Feb 2026 Périphériques et Matériels de Contrôle SAS (Groupe Carrus)Betting terminal manufacturer PMC: CJIP over payments to the head of state-owned PMU Mali €499,150
From 2008 to 2011, the Paris-based supplier of betting and gaming terminals made unjustified payments of 78,972 EUR to the head of the majority state-owned Pari Mutuel Urbain Mali, with which it had a supply contract awarded without a tender. The case was triggered by a report from TRACFIN (the French financial intelligence unit). Public interest fine of 499,150 EUR (including 335,000 EUR already seized) and a three-year AFA compliance programme.
Managers of state-controlled companies are also public officials – even small private payments to them create a risk of criminal liability for medium-sized companies.
Payments to heads of state-owned companies abroad
- Authority / court
- Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris
- Area of law
- Bribery and corruption · Bribery of public officials
- Legal basis
- Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger und Geldwäsche
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 50 to 249
- Culpability
- intentional
- Liability of senior managers
- The CJIP does not address the criminal liability of natural persons.
- Published
- 18 Feb 2026
- Communiqué de presse du procureur de la République financier – CJIP PMC Press release of an authority
- Convention judiciaire d'intérêt public – Périphériques et Matériels de Contrôle SAS Decision of an authority
- Ministère de la Justice: Conventions judiciaires d'intérêt public (Verzeichnis) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 Jan 2026 France TravailCNIL: 5 million EUR against France Travail after social engineering attack €5m
In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.
Accounts of external partners with extensive data access need strong authentication, narrow rights and anomaly detection – and their users need training against social engineering.
Social engineering and account takeover
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 32 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Employees
- 10,000 or more
- Published
- 29 Jan 2026
- Violation de données : sanction de 5 millions d'euros à l'encontre de FRANCE TRAVAIL Press release of an authority
- CNIL – Les sanctions prononcées par la CNIL (Eintrag 22/01/2026) Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
8 Jan 2026 Free Mobile SAS und Free SASCNIL: 42 million EUR against Free Mobile and Free after data leak affecting 24 million contracts €42m
Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.
Put remote access such as VPN behind multi-factor authentication, and consistently delete legacy data from terminated contracts.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.
- Published
- 14 Jan 2026
- Violation de données : sanction de 42 millions d'euros à l'encontre des sociétés FREE MOBILE et FREE Press release of an authority
- Délibération SAN-2026-001 du 8 janvier 2026 (FREE MOBILE) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Dec 2025 Amazon France Logistique SASConseil d'État reduces CNIL fine against Amazon France Logistique to 15 million EUR €15m
In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.
Store employee performance metrics only for as long and in as much detail as their specific purpose requires.
- Authority / court
- Conseil d'État
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Transport, logistics and shipping
- Employees
- 10,000 or more
- Conseil d'État, décision n° 492830 du 23 décembre 2025 Court decision
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 Dec 2025 Nexpublica FranceCNIL: 1.7 million EUR against processor Nexpublica over security flaws €1.7m
As a processor, Nexpublica developed and operated the case management software ‘Public CRM’ for the disability authority MDPH Nord. Following two data breaches in 2022, audits revealed critical vulnerabilities that had existed since 2021, such as outdated SHA-1 hashing; the French data protection authority (CNIL) imposed 1.7 million EUR directly on the service provider.
Processors are themselves liable for the data security of their software; do not leave known vulnerabilities unaddressed until the next breach.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Data processors
- Legal basis
- Art. 32 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Délibération SAN-2025-015 du 22 décembre 2025 (NEXPUBLICA FRANCE) Decision of an authority
- Les sanctions prononcées par la CNIL Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 Nov 2025 American Express Carte FranceAmerican Express Carte France: 1.5 million EUR – marketing cookies despite ‘Reject all’ €1.5m
When the website was accessed, eight non-exempt cookies were placed without any user action; after ‘Reject all’, three marketing cookies were nevertheless placed when switching to an affiliated domain, and after consent was withdrawn, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 1.5 million EUR for this and, in view of the rectification during the proceedings, refrained from issuing an order; it found an infringement of data minimisation in the recording of customer calls but did not sanction it.
Cookie settings must apply across all domains of a service – including when users move to affiliated sites.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés (Geldbuße); Verstoß gegen Art. 5 Abs. 1 lit. c DSGVO (Gesprächsaufzeichnungen) festgestellt, aber nicht sanktioniert
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Mitigating circumstances
- Corrections during the proceedings, cooperation.
- CNIL, Délibération SAN-2025-011 du 27 novembre 2025 (Légifrance) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 Nov 2025 Les Publications Condé NastCNIL: 750,000 EUR against Vanity Fair publisher Condé Nast over cookies without consent €750,000
On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.
A cookie banner must technically deliver what it promises: after ‘Reject’, no further trackers may be set – and this should be tested regularly.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Repeat case
- yes
- Published
- 27 Nov 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
17 Nov 2025 TotalEnergies Marketing France, Rubis Énergie, Rubis Terminal, EG RetailFrance: 187.5 million EUR against fuel suppliers over depot agreement in Corsica €187.5m
Between 2016 and 2023, the shareholders of the Corsican fuel storage company DPLC made the use of the depots conditional on a shareholding by means of a contractual clause; non-shareholders had to buy their fuel from their competitors, which could push up pump prices in Corsica (decision 25-D-07). Fines: TotalEnergies Marketing France 115.82 million EUR, Rubis 64.67 million EUR, EG Retail 7 million EUR.
Shared infrastructure of competitors must be open to third parties on fair terms – shareholder agreements should be reviewed under competition law.
Joint ventures of competitors and access conditions for third parties
- Authority / court
- Autorité de la concurrence
- Area of law
- Competition law · Cartels and collusion
- Legal basis
- Art. L.420-1 Code de commerce, Art. 101 AEUV
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Energy and utilities
- Employees
- 10,000 or more
- Published
- 17 Nov 2025
- Carburants en Corse : l'Autorité de la concurrence inflige une sanction de 187,5 millions d'euros Press release of an authority
- Décision 25-D-07 relative à des pratiques mises en œuvre dans le secteur de l'approvisionnement, du stockage et de la distribution des carburants en Corse Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 Nov 2025 DoctolibFrance: 4.665 million EUR against Doctolib for abuse in doctor appointment booking €4.67m
Doctolib tied doctors with exclusivity clauses, bundled telemedicine with the appointment booking subscription and in 2018 acquired its main competitor MonDocteur in order to eliminate it (decision 25-D-06). Fines: 4.615 million EUR for exclusivity and tying, 50,000 EUR for the acquisition.
Platforms with high market shares should have exclusivity clauses, bundled offers and acquisitions of rivals reviewed under competition law.
- Authority / court
- Autorité de la concurrence
- Area of law
- Competition law · Abuse of market power
- Legal basis
- Art. 102 AEUV, Art. L.420-2 Code de commerce
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Healthcare
- Culpability
- intentional
- Published
- 6 Nov 2025
- L'Autorité de la concurrence sanctionne Doctolib à hauteur de 4 665 000 euros Press release of an authority
- Décision 25-D-06 relative à des pratiques mises en œuvre dans le secteur de la prise de rendez-vous médicaux en ligne Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
3 Nov 2025 Groupe ParfaitFrance: 7.6 million EUR against Groupe Parfait for failing to meet merger remedies (Martinique) €7.6m
In 2022, clearance of an acquisition in food retail in Martinique was made conditional on the divestiture of a Géant Casino hypermarket by September 2023; Parfait only sold it in September 2025, allowed the value of the assets to deteriorate and obstructed the trustee (decision 25-D-05). Fines: 4.5 million EUR (divestiture), 2.5 million EUR (preservation of value), 600,000 EUR (cooperation).
Merger control commitments are binding – missed deadlines and a lack of cooperation with the trustee are sanctioned separately.
Compliance with merger remedies and cooperation with trustees
- Authority / court
- Autorité de la concurrence
- Area of law
- Competition law · Merger control
- Legal basis
- Verstoß gegen Zusagen aus Freigabeentscheidung 22-DCC-254 (Fusionskontrolle, Code de commerce)
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Retail and e-commerce
- Published
- 3 Nov 2025
- Distribution alimentaire à la Martinique : l'Autorité inflige au groupe Parfait des sanctions (25-D-05) Press release of an authority
- Décision 25-D-05 relative au respect des engagements annexés à la décision n° 22-DCC-254 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Oct 2025 TotalEnergies; TotalEnergies Electricité et Gaz de FranceParis Judicial Court: TotalEnergies advertising on climate neutrality misleading Order
In an action brought by Greenpeace France, Les Amis de la Terre and Notre Affaire à Tous, the Paris Judicial Court (Tribunal judiciaire de Paris, 34th chamber) found that TotalEnergies had advertised on totalenergies.fr with the goal of ‘carbon neutrality by 2050’ and its role as a player in the energy transition without disclosing that oil and gas production continues to be expanded – a misleading commercial practice. The court ordered the communication to cease, damages to be paid to the associations and the operative part of the judgment to be published on the website (RG 22/02955); claims relating to gas and agrofuels were dismissed.
Net-zero targets may only be advertised to consumers with reference to the actual business strategy.
Climate targets in consumer communication
- Authority / court
- Tribunal judiciaire de Paris (34. Kammer)
- Area of law
- Environment and sustainability · Misleading environmental and sustainability claims
- Legal basis
- Art. L121-1 ff. Code de la consommation (Umsetzung der Richtlinie 2005/29/EG)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Energy and utilities
- Employees
- 10,000 or more
- Published
- 23 Oct 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
3 Sep 2025 SURYS SAS (Gruppe Imprimerie Nationale)Hologram manufacturer SURYS: CJIP of 18.4 million EUR in the Ukrainian passport case €18.4m
From 2013, SURYS supplied security holograms for Ukrainian passports to the state-owned company Polygraph via an interposed Estonian company; the investigation (following a request for mutual legal assistance from Ukraine's National Anti-Corruption Bureau, NABU) concerned misappropriation of public funds, bribery of foreign public officials and money laundering. Public interest fine of 18,363,007 EUR, plus 3,770,000 EUR in damages to the Ukrainian state and a three-year AFA compliance programme.
If a state customer insists on an interposed trader without any discernible added value, treat this as a red flag for misappropriation and bribery.
Interposed trading companies and sales agents
- Authority / court
- Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris
- Area of law
- Bribery and corruption · Bribery of public officials
- Legal basis
- Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger, Geldwäsche
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Employees
- 250 to 999
- Culpability
- intentional
- Liability of senior managers
- The CJIP does not address the criminal liability of natural persons.
- Published
- 3 Sep 2025
- Communiqué de presse du procureur de la République financier – CJIP SURYS Press release of an authority
- Convention judiciaire d'intérêt public – SURYS (08.07.2025) Decision of an authority
- Ministère de la Justice: Conventions judiciaires d'intérêt public (Verzeichnis) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Google LLC und Google Ireland LimitedGoogle: 325 million EUR – advertising cookies at account creation and ads in the Gmail inbox €325m
When creating a Google account, users were not sufficiently informed that advertising cookies were necessarily placed in the process; in addition, Google displayed advertisements between e-mails in Gmail without prior consent. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 200 million EUR on Google LLC and 125 million EUR on Google Ireland and ordered remedial action within six months, subject to a penalty payment of 100,000 EUR per day.
Do not tacitly tie advertising cookies to account creation – and advertising in the inbox counts as direct marketing requiring consent.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés; Art. L. 34-5 Code des postes et des communications électroniques
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Sep 2025 Infinite Styles Services Co. Limited (Shein)Shein: 150 million EUR – cookies without consent and despite rejection €150m
On shein.com, advertising cookies were placed without consent as soon as the site was accessed; in addition to an incomplete cookie banner, there was an advertising pop-up without an option to reject. After clicking ‘Reject all’ or withdrawing consent, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 150 million EUR.
A cookie banner must work technically: rejecting and withdrawing consent must actually stop cookies from being placed and read.
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Cookies and tracking
- Legal basis
- Art. 82 Loi Informatique et Libertés (Umsetzung von Art. 5 Abs. 3 ePrivacy-Richtlinie)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Jun 2025 Exclusive Networks Corporate SASIT distributor Exclusive Networks: CJIP of 16 million EUR following a whistleblower report €16.1m
In 2021, a whistleblower reported payments by subsidiaries in Indonesia, Malaysia, Vietnam, Thailand and India to contractual partners; the investigation concerned private-sector bribery and bribery of foreign public officials. The CJIP provides for a public interest fine of 16,074,511 EUR (including 1 million EUR already seized) and a three-year AFA compliance programme.
A functioning whistleblowing system uncovers foreign risks – companies should investigate reports themselves before the authorities do.
Payments to sales partners in Asia, whistleblowing systems
- Authority / court
- Parquet national financier (PNF); Validierung durch das Tribunal judiciaire de Paris
- Area of law
- Bribery and corruption · Commercial bribery
- Legal basis
- Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung im privaten Sektor und ausländischer Amtsträger
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Employees
- 1,000 to 9,999
- Culpability
- intentional
- Liability of senior managers
- The CJIP does not address the criminal liability of natural persons.
- Published
- 19 Jun 2025
- Communiqué de presse du procureur de la République financier – CJIP Exclusive Networks Corporate Press release of an authority
- CJIP société Exclusive Networks Corporate (16.06.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
10 Jun 2025 SMCP SA; European TopSoho S.à r.l.; Dynamic Treasure GroupSMCP: threshold notifications missed, misleading announcement, inside information not protected €1.72m
In connection with the change of control at the fashion group SMCP in 2021/22, the major shareholder European TopSoho (ETS) and Dynamic Treasure Group failed to make threshold notifications; ETS also disseminated a misleading press release. SMCP itself failed to maintain the confidentiality of inside information. Sanctions imposed by the Enforcement Committee of France's financial markets authority (Autorité des marchés financiers, AMF): Chenran Qiu 1 million EUR, ETS 400,000 EUR, DTG 300,000 EUR, SMCP 20,000 EUR.
Issuers must effectively shield inside information even when the conflict originates with the major shareholder.
Ensuring the confidentiality of inside information
- Authority / court
- Autorité des marchés financiers (AMF), Commission des sanctions
- Area of law
- Capital markets and financial supervision · Market abuse and insider dealing
- Legal basis
- Art. L. 233-7 Code de commerce; Art. 223-14 RG AMF; Art. 12 Abs. 1 lit. c MAR; Art. 2 Abs. 1 DVO (EU) 2016/1055
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Retail and e-commerce
- Liability of senior managers
- Chenran Qiu: 1,000,000 EUR (ETS's infringements attributed to her)
- Décision SAN-2025-05 Decision of an authority
- Décision n° 5 du 10 juin 2025 (PDF) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Feb 2025 KLUBB France SASVehicle body builder KLUBB France: CJIP over an ambulance contract in Algeria €558,024
Following a referral from the public prosecutor's office in Rennes, the PNF investigated bribery of foreign public officials in the performance of a contract for the supply of ambulances to Algeria. KLUBB France is paying a public interest fine of 558,024 EUR and is undergoing a three-year AFA compliance programme.
Medium-sized exporters are also in the spotlight: companies supplying foreign authorities need a robust anti-corruption programme under Sapin II (the French anti-corruption law).
Export contracts with state bodies
- Authority / court
- Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris
- Area of law
- Bribery and corruption · Bribery of public officials
- Legal basis
- Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger
- Action
- Fine
- Status of proceedings
- final
- Sector
- Manufacturing and mechanical engineering
- Employees
- 50 to 249
- Culpability
- intentional
- Liability of senior managers
- The CJIP does not address the criminal liability of natural persons.
- Published
- 11 Feb 2025
- Communiqué de presse du procureur de la République financier – CJIP KLUBB France Press release of an authority
- CJIP KLUBB France SAS (10.02.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 Jan 2025 Pharnext SAPharnext: FDA setbacks disclosed late and glossed over €800,000
The biotech company did not disclose as soon as possible the FDA's request for an additional study on PXT-3003 and the subsequent rejection of an SPA application, and disseminated misleading communications to shareholders. Sanctions: Pharnext 500,000 EUR, former CEO Daniel Cohen 200,000 EUR, former CEO David Horn Solomon 100,000 EUR.
Negative feedback from regulatory authorities is regularly inside information and must not be given a positive spin in letters to shareholders.
- Authority / court
- Autorité des marchés financiers (AMF), Commission des sanctions
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- Art. 17 MAR; Art. 12 Abs. 1 lit. c und Art. 15 MAR
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Chemicals and pharmaceuticals
- Liability of senior managers
- Daniel Cohen (co-founder, directeur général until April 2020): 200,000 EUR; David Horn Solomon (directeur général from April 2020): 100,000 EUR
- Décision SAN-2025-01 Decision of an authority
- Décision n° 1 du 20 janvier 2025 (PDF) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Dec 2024 CNIL: 40,000 EUR against estate agency over constant video surveillance of staff €40,000
An estate agency (name redacted in the publication) continuously filmed workstations and break areas with image and sound, accessible via a smartphone app, and used the software Time Doctor to record keyboard and mouse activity as well as screenshots of the computers; several people accessed this data via the administrator account of one of them. The French data protection authority (CNIL) found infringements of data minimisation, legal basis, information, security and the obligation to carry out an impact assessment, and imposed 40,000 EUR.
Permanent video and audio recording of workplaces is practically never proportionate – not even in a small business.
Permissible employee monitoring and password security
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. c, Art. 6, 12, 13, 32, 35 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- Délibération SAN-2024-021 du 19 décembre 2024 Decision of an authority
- CNIL – Les sanctions prononcées par la CNIL (Eintrag 19/12/2024, agence immobilière) Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Jul 2024 Parrot SAParrot: misleading half-yearly report and insider dealing ahead of a takeover bid €420,000
In its 2018 half-yearly report, the drone manufacturer disseminated misleading information on the absence of impairment indicators for the drone division, on goodwill and on earnings; in addition, the deputy managing director used inside information about a planned takeover bid. Sanctions: Parrot 150,000 EUR, CEO Henri Seydoux 60,000 EUR, Gilles Labossière 210,000 EUR.
Impairment tests for loss-making divisions and trading bans for management are particularly sensitive in a takeover context.
Insider dealing ban for executives in connection with takeover plans
- Authority / court
- Autorité des marchés financiers (AMF), Commission des sanctions
- Area of law
- Capital markets and financial supervision · Market abuse and insider dealing
- Legal basis
- Art. 12 Abs. 1 lit. c, Art. 15 MAR; Art. 8 und 14 MAR
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Liability of senior managers
- Henri Seydoux (Président-directeur général): 60,000 EUR; Gilles Labossière (directeur général délégué): 210,000 EUR, including for insider dealing
- Décision SAN-2024-07 Decision of an authority
- Décision n° 7 du 19 juillet 2024 (PDF) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link