Privacy & Information Security Law Blog

On October 1, 2020, the French Data Protection Authority (the “CNIL”) published a revised version of its guidelines on cookies and similar technologies (the “Guidelines”), its final recommendations on the practical modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices (the “Recommendations”) and a set of questions and answers on the Recommendations (“FAQs”).

Background

On July 18, 2019, the CNIL published the Guidelines to specify the rules applicable to the use of cookies and similar technologies in France in light of the strengthened consent requirements of the EU General Data Protection Regulation (“GDPR”). The Guidelines were to be complemented by the Recommendations to guide businesses in implementing those rules by offering concrete examples of user interface to get consent for non-essential cookies and similar technologies. On January 14, 2020, the CNIL published the draft Recommendations, which were open to public consultation until February 25, 2020.

On June 19, 2020, France’s Highest Administrative Court (the “Conseil d’Etat”) issued a decision partially annulling the Guidelines. The Conseil d’Etat annulled the provision of the Guidelines imposing a general and absolute ban on ‘cookie walls’ that prevent users who do not consent to the use of cookies from accessing a site or mobile app. On the day of the Conseil d’Etat’s decision, the CNIL published a statement announcing that they will revise their Guidelines accordingly.

CNIL’s Guidelines and Recommendations on Cookies

Key takeaways from the new Guidelines and Recommendations include:

• Users’ consent to be obtained on each site: The CNIL previously considered that it was acceptable to seek users’ consent for a group of sites if users were informed of the exact scope of their consent. The CNIL now strongly recommends seeking users’ consent individually for each site, when non-essential cookies are set by other entities than the web publisher and those cookies enable tracking of users’ activities through other sites.
• Information to be provided to users to get ‘informed’ consent: The Guidelines slightly extend the list of information to be provided – as a minimum – to users to get their informed consent. Users must not only be informed of the identity of the data controller(s), the purpose(s) of the use of cookies and similar technologies and the existence of their right to withdraw consent, but they also must be informed of at least how they can accept or refuse cookies and similar technologies and the consequences of such acceptation or refusal.
• Possibility to refuse cookies with the same simplicity as to give consent: Both the Guidelines and the Recommendations emphasize that it must be as easy to accept the use of cookies or to refuse the use. Consent interfaces that only include “Accept All” and “Customize Settings” buttons, whereby users can accept all cookies by one click but may reject them via several clicks, are not lawful. If there is an “Accept All” button, there must be a “Reject All” button of the same size and at the same level on the interface. Alternatively, the consent interface could include a link “Continue without accepting.” It must be clear to users how they can reject cookies.
• Users’ refusal deduced from their silence: The CNIL previously recognized the possibility for users to delay their choice, and recommended inserting a “cross” button in the consent interface to that end. The CNIL now considers that users’ silence, inaction or action (other than a clear positive act expressing their consent) must be interpreted as a refusal to have cookie set on their devices.
• More flexible consent exemption conditions for analytics cookies: The CNIL has historically considered that analytics cookies could be exempt from the consent requirement, subject to strict conditions, including the ability for users to opt out of having such cookies. As a result, very few analytics solutions could benefit from the consent exemption. The CNIL has now softened these conditions. However, the consent exemption still only applies to analytics cookies whose purpose is limited to measuring the audience of the site or app only on behalf of the web publisher. These analytics cookies must be used solely to produce anonymous statistics, and the personal data collected through the cookies must not be combined with other data or processing activities and must not be shared with third parties.
• Cookie walls: The Guidelines no longer imposes a general and absolute ban on ‘cookie walls.’ However, the CNIL considers that this practice is likely to affect freedom of consent in certain cases, and the lawfulness of the practice must be assessed on a case-by-case basis. Further, if a ‘cookie wall’ is implemented, users must be clearly informed of the consequences of their choices, in particular the inability to access the content of the site or app or the service if they do not give consent.

Next Steps

The CNIL will allow for a transition period of six months to comply with the new cookie law rules (i.e., until the end of March 2021). The CNIL will carry out inspections to enforce the Guidelines after that transition period. However, in accordance with the case law of the Conseil d’Etat, the CNIL reserves the right to take action against certain infringements, in particular in case of particularly serious infringements of the right to privacy. In addition, during the transition period, the CNIL will continue to investigate infringements of the previous cookie law rules.

View the CNIL’s final Recommendations and FAQs (currently only available in French).