Sadly I don't see how this decision can be translated into practice, since I strongly doubt the CNIL will be able (or willing) to send formal notice, and fine after a grace period, all French companies that make use of Google Analytics on their website.
Why is the onus on the CNIL to notify companies on the law (which they actually did by issuing this press release) and not on companies to keep up-to-date with the law (which they could to by reading the news)?
This is just how it works. I'm not making the rules. The CNIL send "mise en demeure" to companies that do not complies with the GDPR and even before that with the "loi informatique et libertés" and if the companies ignore the "mise en demeure" after some time the CNIL can fine them.
It also happens that the CNIL is notoriously more and more lenient on a lot of things.
