CNIL Publishes Updated Cookie Guidelines and Final Version of Recommendations on How to Get Users’ Consent
On October 1, 2020, the French Data Protection Authority (the “CNIL”) published a revised version of its guidelines on cookies and similar technologies (the “Guidelines”), its final recommendations on the practical modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices (the “Recommendations”) and a set of questions and answers on the Recommendations (“FAQs”).
CNIL’s Guidelines and Recommendations on Cookies
Key takeaways from the new Guidelines and Recommendations include:
Users’ consent to be obtained on each site: The CNIL previously considered that it was acceptable to seek users’ consent for a group of sites if users were informed of the exact scope of their consent. The CNIL now strongly recommends seeking users’ consent individually for each site, when non-essential cookies are set by other entities than the web publisher and those cookies enable tracking of users’ activities through other sites.
Users’ refusal deduced from their silence: The CNIL previously recognized the possibility for users to delay their choice, and recommended inserting a “cross” button in the consent interface to that end. The CNIL now considers that users’ silence, inaction or action (other than a clear positive act expressing their consent) must be interpreted as a refusal to have cookie set on their devices.
More flexible consent exemption conditions for analytics cookies: The CNIL has historically considered that analytics cookies could be exempt from the consent requirement, subject to strict conditions, including the ability for users to opt out of having such cookies. As a result, very few analytics solutions could benefit from the consent exemption. The CNIL has now softened these conditions. However, the consent exemption still only applies to analytics cookies whose purpose is limited to measuring the audience of the site or app only on behalf of the web publisher. These analytics cookies must be used solely to produce anonymous statistics, and the personal data collected through the cookies must not be combined with other data or processing activities and must not be shared with third parties.
Cookie walls: The Guidelines no longer imposes a general and absolute ban on ‘cookie walls.’ However, the CNIL considers that this practice is likely to affect freedom of consent in certain cases, and the lawfulness of the practice must be assessed on a case-by-case basis. Further, if a ‘cookie wall’ is implemented, users must be clearly informed of the consequences of their choices, in particular the inability to access the content of the site or app or the service if they do not give consent.
The CNIL will allow for a transition period of six months to comply with the new cookie law rules (i.e., until the end of March 2021). The CNIL will carry out inspections to enforce the Guidelines after that transition period. However, in accordance with the case law of the Conseil d’Etat, the CNIL reserves the right to take action against certain infringements, in particular in case of particularly serious infringements of the right to privacy. In addition, during the transition period, the CNIL will continue to investigate infringements of the previous cookie law rules.