France Tightens the Legal Framework for Algorithmic Video Surveillance: The Council of State Upholds CNIL’s Decision Against the City of Nice

In a landmark decision rendered on 30 January 2026, the French Council of State clarified the legal limits applicable to the use of algorithmic video surveillance by public authorities. Ruling on an appeal brought by the City of Nice, the Court upheld the position of the French Data Protection Authority (CNIL) and confirmed that, in the absence of an explicit legal basis, algorithmic analysis of video surveillance footage cannot be lawfully implemented, even for public security purposes.

French Council of State, 30 January 2026, City of Nice, No. 506370

1. Background: an algorithmic monitoring system at school entrances

Following an inspection carried out in April 2023, the CNIL requested that the City of Nice submit a Data Protection Impact Assessment (DPIA) relating to several algorithmic video-processing systems, including a system referred to as “school entrance intrusion zone”.

The system was designed to:

• automatically analyse video footage captured in public spaces;
• detect vehicles stopping or parking in front of schools;
• trigger alerts to municipal police services in real time.

By a decision dated 15 May 2025, the CNIL concluded that such processing could not be lawfully implemented under the current legal framework and therefore prohibited its deployment. The City of Nice challenged this decision before the French Council of State.

‍

2. Procedural legality confirmed by the Court

The Council of State first dismissed all procedural arguments raised by the City.

It held that:

• the CNIL had deliberated in accordance with quorum and voting requirements;
• the decision was sufficiently reasoned in both law and fact;
• no procedural irregularity could be established.

As a result, the legality of the CNIL’s decision-making process was fully upheld.

‍

3. No legal basis for algorithmic video analysis under current French law

On the merits, the Court adopted a strict interpretation of the applicable legal framework.

It recalled that Articles L.251-1 et seq. of the French Internal Security Code authorise the use of video surveillance systems in public spaces, but do not authorise the automated algorithmic analysis of video feeds.

The contested system went beyond mere image capture, as it involved:

• continuous automated analysis,
• algorithmic detection of specific behaviours,
• automated alerting mechanisms.

The Court held that such processing constitutes a distinct form of data processing requiring a specific legislative basis, which does not currently exist in French law.

‍

4. Irrelevance of the AI Act classification

The City of Nice argued that the system did not qualify as a “high-risk AI system” under the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).

The Council of State rejected this argument, stating that:

• even if the system were not classified as “high-risk” under the AI Act,
• this would not compensate for the absence of a national legal basis authorising its deployment.

In other words, compliance with the AI Act cannot replace the requirement for a clear domestic legal authorisation when public authorities seek to deploy algorithmic surveillance tools.

‍

5. Key takeaways and legal implications

This decision is particularly significant for public authorities and AI developers in Europe:

• It confirms a strict interpretation of public authorities’ powers regarding algorithmic surveillance.
• It reaffirms that algorithmic video analysis requires explicit legislative authorisation, beyond general video surveillance rules.
• It strengthens the CNIL’s role as a gatekeeper of algorithmic uses in public spaces.
• It anticipates future legal debates on the interaction between national law, the GDPR, and the EU AI Act.

In practical terms, the ruling effectively prevents French local authorities from deploying algorithmic video surveillance systems unless and until a specific legal framework is adopted by the legislature.