Cybersecurity Policy Report, Recommendations on Web-Filtering Published in France, (Jul 30, 2025)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has published draft recommendations designed to support data controllers that deploy web-filtering gateways.

CNIL explained in a news release that a web-filtering gateway, often referred to as a filtering web proxy, is a device or service used to control and monitor Internet access by filtering web content according to predefined policies. These gateways seek to block access to certain websites or categories of content for security and compliance reasons.

Citing the digitalization of economic activity and the resulting increase in cyber threats, CNIL said web-filtering tools had evolved to include technologies combining artificial intelligence, pooling, and the use of various information, automated decision-making, or analysis of user behavior. Web-filtering can help organizations meet their security obligations under article 32 of the European Union’s General Data Protection Regulation, CNIL said, but also involve the processing of personal data that must comply with the GDPR.

The draft recommendation, which may be accessed from the news release but is available only in French, targets data controllers using web-filtering gateways to secure browsing on their information systems by employees, agents, service providers, and outside visitors. It is limited to the professional context and does not deal with the use of web-filtering gateways by data controllers providing Internet access via a public Wi-Fi hotspot.

The consultation is aimed at the data protection officers and chief information security officers of data controllers and processors, as well as web-filtering gateway solution providers. The consultation is open through Sept. 30 via this consultation page. Contributions made during the consultation will be analyzed to allow the publication of a final recommendation after its adoption by the CNIL board.

News: InternationalLegislation DataSecurity DataPrivacy GDPR