Retargeting for Small Businesses: Re-Engage Visitors Without Risking a CNIL Fine in 2026

Very few visitors to your website actually buy on their first visit: according to data compiled by Ranktracker, a website converts on average only 2 to 3% of its visitors, and 97 to 98% of them leave without completing a purchase or filling out a form. Retargeting, which consists of re-engaging these visitors on other channels, helps recover part of that already-interested audience. But in 2026, this practice has entered a new era: the French data protection authority (CNIL) issued 487 million euros in cookie-related fines in 2025, and now monitors consent banners with an automated crawler launched in January 2026.

For a small or mid-sized business, retargeting remains one of the most profitable levers of digital marketing, provided it is set up by the book. Here is the complete method for launching an effective and compliant campaign in 2026.

What is retargeting and why it is changing shape in 2026

Retargeting (or remarketing) consists of showing targeted ads to internet users who have already visited your site without converting. Technically, it relies on placing a cookie or advertising identifier during the first visit, which then allows the visitor to be tracked across other platforms (social media, partner sites, search engines) to display a relevant ad.

Three channels dominate the practice for small and mid-sized businesses:

• Social media (Meta Ads on Facebook and Instagram, LinkedIn Ads for B2B) with custom audiences built from site traffic.
• Display advertising via Google Ads, which shows banners across Google's partner network.
• Email marketing, to re-engage an identified visitor (newsletter subscriber, abandoned cart) without relying on a third-party advertising cookie.

What has changed in 2026 is the regulatory environment around these techniques, and that is precisely what separates a profitable campaign from one that exposes the business to financial risk.

The numbers that justify investing in retargeting in 2026

Retargeting remains one of the most profitable levers of digital marketing for a simple reason: it targets an already-qualified audience. A few useful benchmarks for building a forecast budget:

• The average conversion rate of a retargeting campaign is around 3.8%, compared with 2 to 3% for a first-time visitor, according to Ranktracker.
• The average cart abandonment rate is close to 70% across all sectors, with peaks above 82% in travel and finance, according to data compiled by ecommerce-nation.
• A retargeting campaign can start with a monthly budget of 100 to 300 euros, making it accessible from the very first months of a small business's activity.

These figures explain why retargeting usefully complements an SEO strategy or a B2B prospecting approach: it captures an audience that has already shown interest, at an acquisition cost generally lower than a classic acquisition campaign.

The new GDPR framework for retargeting in 2026: what has changed

Retargeting relies on advertising cookies and trackers which, according to the CNIL, require prior, free, specific, informed and unambiguous consent from the internet user. This principle is not new, but its enforcement has tightened considerably since the start of 2026.

A CNIL crawler now monitors banners continuously

Since January 2026, the CNIL has used an automated crawler that continuously checks consent banner compliance on French websites. This tool no longer just checks the banner's appearance: it analyzes the actual behavior of scripts after the click, to make sure no non-essential tracker runs before acceptance. This monitoring has already resulted in 23 simplified sanctions, for a total of 133,750 euros.

Sanctions that are changing scale

Beyond these first automated sanctions, several major decisions came down between 2025 and 2026: Google was fined 325 million euros in September 2025 for cookies deployed without valid consent, Shein 150 million euros the same year for trackers that stayed active after a "Refuse" click, and American Express 1.5 million euros in November 2025 for advertising cookies deployed as soon as a user landed on the site, before any choice was made. On March 4, 2026, France's highest administrative court (Conseil d'État) definitively upheld the 40 million euro fine against Criteo, precisely for lack of proof of valid consent on its retargeting cookies, which is the very core of retargeting activity. In total, cookie-related sanctions reached 487 million euros in 2025.

These amounts concern large groups, but the legal principle behind them (no proof of consent, trackers active before the click) applies just the same to a small business using a poorly configured Meta pixel or Google Ads tag. Our GDPR and cookie compliance guide for small businesses details how to set up a compliant consent banner, a prerequisite for any retargeting campaign.

What consent must specifically cover

A point often misunderstood by small businesses: accepting a newsletter does not count as consent for retargeting via a third-party ad network. Each purpose (audience measurement, advertising, social media) requires a distinct legal basis, collected separately. Withdrawing consent must also be as simple as giving it, and must apply across the whole chain: stopping new ad sends, effective exclusion from targeting, and purging queues already built. Simply disabling the browser tag is not enough.

Setting up a compliant retargeting campaign in 5 steps

1. Segment your audiences before spending a single euro

Don't retarget all your visitors the same way. Distinguish at least three segments: visitors who viewed a product or service page without converting, abandoned carts or forms left mid-way, and existing customers for complementary offers. Each segment deserves a different message and budget, since their conversion probability is not comparable.

2. Choose channels based on budget and audience

For a B2C business, Meta Ads is often the most profitable channel to start with, offering precise targeting and a low entry cost. For a B2B business, LinkedIn Ads allows retargeting by job function or industry, complementing a LinkedIn social selling approach. Follow-up emails don't require a third-party cookie as long as the address was collected with proper consent, often making it the simplest channel to bring into compliance for a business just getting started.

3. Bring your consent banner into compliance before launching any campaign

No retargeting pixel should fire before the user clicks "Accept". The "Reject all" button must be as visible and accessible as the "Accept all" button, and proof of each visitor's choice must be kept, with consent typically valid for 13 months. This is a technical prerequisite, not an option: a quick audit of your current banner lets you verify that no advertising script loads before the click.

4. Set a reasoned frequency and retention period

There is no single legal retention period for retargeting data, but the CNIL expects a duration justified by the campaign's actual needs rather than the maximum technically available. Also cap how often a given visitor sees your ads: beyond a few exposures per week, the effect becomes counterproductive and damages brand image.

5. Measure and optimize continuously

Track at least three indicators: conversion rate per segment, cost per acquisition, and average exposure frequency. A SEO and acquisition dashboard helps put this data into perspective alongside the rest of your acquisition strategy, especially to arbitrate budget between organic search and paid campaigns.

Retargeting budget for small businesses: how much to plan

A retargeting campaign can start with a monthly budget of 100 to 300 euros, making it one of the most accessible advertising levers for a small business. This budget covers a limited traffic volume (a few hundred to a few thousand monthly visitors) on one or two channels. As site traffic grows, notably thanks to an SEO strategy or a well-prepared website redesign, the retargeting budget should be scaled up to keep covering the whole retargetable audience.

It is generally recommended not to exceed 15 to 20% of the total advertising budget on retargeting alone, with the rest dedicated to acquiring new visitors. A good starting point: check your Google Business Profile listing and automate the collection of customer reviews, two free levers that improve conversion before you even spend on retargeting.

Costly mistakes (and how to avoid them)

• Firing pixels before consent. This is the most frequent and most heavily sanctioned mistake: a Meta pixel or Google Ads tag must be configured to load only after explicit acceptance of advertising cookies.
• Confusing newsletter consent with advertising consent. A newsletter subscriber has not necessarily agreed to be retargeted by a third-party ad network.
• Building audiences from sensitive criteria. Article 9 of the GDPR protects data revealing health, religious beliefs or political opinions: your audiences must not allow these traits to be inferred, even indirectly.
• Neglecting consent withdrawal. A visitor who withdraws consent must be effectively excluded from targeting, not just from future ad sends: queues already sent to ad networks must also be purged.
• Over-targeting the same audience. An excessive exposure frequency damages both ad performance and brand image.

For businesses combining several acquisition channels, the trade-off between organic search, paid campaigns and retargeting deserves to be laid out clearly before allocating budget; that is exactly the subject of our article on choosing between SEO and Google Ads.

Retargeting does not replace an acquisition strategy: it extends it. A business that attracts little qualified traffic will have little audience to retarget, whatever the budget invested.

If your site still generates too little qualified traffic, the priority is often to rework the site itself: structure, loading speed and conversion path. Our team supports small and mid-sized businesses on these levers through our website creation and digital marketing offerings. For a diagnosis, contact our team.

Frequently asked questions

Does retargeting still work as third-party cookies gradually disappear?

Yes, but the channels are evolving. Custom audiences on social media (Meta, LinkedIn) increasingly rely on proprietary identifiers and imported customer lists rather than classic third-party cookies. Email marketing, which doesn't depend on these cookies, remains a reliable retargeting channel as long as the list was collected with valid consent.

Does a small business really risk a CNIL sanction?

The CNIL's automated crawler, active since January 2026, monitors all French websites regardless of size: 23 simplified sanctions have already been issued since its launch. The amounts for a small business are obviously not comparable to fines against large groups, but the automated monitoring principle applies to every site with a non-compliant cookie banner.

What is the difference between retargeting and remarketing?

The two terms are often used interchangeably. In practice, retargeting more often refers to display and social media ad reciprocity, while remarketing tends to refer to email follow-ups, for example for an abandoned cart. The consent requirement applies in both cases as soon as a cookie or tracker is used.

Do I need a minimum budget to start retargeting?

No. A campaign can start with 100 to 300 euros per month on a single channel, provided the site already generates enough traffic to build a usable audience (generally at least a few hundred monthly visitors).

Is retargeting suited to all small business activities?

It is particularly effective for activities with a decision cycle that extends beyond the first visit (e-commerce, quote-based services, long B2B cycles). For a local business with low traffic volume, it may be more relevant to prioritize local SEO and the Google Business Profile listing first, before investing in paid retargeting.