On October 1, 2020, the French Data Protection Authority (the “CNIL”) published a revised version of its guidelines on cookies and similar technologies (the “Guidelines”), its final recommendations on the practical modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices (the “Recommendations”) and a set of questions and answers on the Recommendations (“FAQs”).
Background
On July 18, 2019, the CNIL published the Guidelines to specify the rules applicable to the use of cookies and similar technologies in France in light of the strengthened consent requirements of the EU General Data Protection Regulation (“GDPR”). The Guidelines were to be complemented by the Recommendations to guide businesses in implementing those rules by offering concrete examples of user interface to get consent for non-essential cookies and similar technologies. On January 14, 2020, the CNIL published the draft Recommendations, which were open to public consultation until February 25, 2020.
On June 19, 2020, France’s Highest Administrative Court (the “Conseil d’Etat”) issued a decision partially annulling the Guidelines. The Conseil d’Etat annulled the provision of the Guidelines imposing a general and absolute ban on ‘cookie walls’ that prevent users who do not consent to the use of cookies from accessing a site or mobile app. On the day of the Conseil d’Etat’s decision, the CNIL published a statement announcing that they will revise their Guidelines accordingly.
CNIL’s Guidelines and Recommendations on Cookies
Key takeaways from the new Guidelines and Recommendations include:
- Users’ consent to be obtained on each site: The CNIL previously considered that it was acceptable to seek users’ consent for a group of sites if users were informed of the exact scope of their consent. The CNIL now strongly recommends seeking users’ consent individually for each site, when non-essential cookies are set by other entities than the web publisher and those cookies enable tracking of users’ activities through other sites.
CookieScan will scan your site on a regular basis to identify new cookies and remove any inactive ones. You can be confident that CookieScan will keep you up-to-date and compliant with the cookie requirements of the law.
- Information to be provided to users to get ‘informed’ consent: The Guidelines slightly extend the list of information to be provided – as a minimum – to users to get their informed consent. Users must not only be informed of the identity of the data controller(s), the purpose(s) of the use of cookies and similar technologies and the existence of their right to withdraw consent, but they also must be informed of at least how they can accept or refuse cookies and similar technologies and the consequences of such acceptation or refusal.
CookieScan provides information to the users about the purpose of each cookie in the selected category in an easy to understand language.
- Possibility to refuse cookies with the same simplicity as to give consent:Both the Guidelines and the Recommendations emphasize that it must be as easy to accept the use of cookies or to refuse the use. Consent interfaces that only include “Accept All” and “Customize Settings” buttons, whereby users can accept all cookies by one click but may reject them via several clicks, are not lawful. If there is an “Accept All” button, there must be a “Reject All” button of the same size and at the same level on the interface. Alternatively, the consent interface could include a link “Continue without accepting.” It must be clear to users how they can reject cookies.
Once the user has selected their choice and saved it on the CookieScan pop-up, the pop-up is minimised leaving a small icon on the bottom left corner of the site. This icon can be selected at any time for the pop-up to reappear so the user can alter their decision on the use of cookies.
- Users’ refusal deduced from their silence:The CNIL previously recognized the possibility for users to delay their choice, and recommended inserting a “cross” button in the consent interface to that end. The CNIL now considers that users’ silence, inaction or action (other than a clear positive act expressing their consent) must be interpreted as a refusal to have cookie set on their devices.
The default setting for CookieScan is to block all cookies, with the exception of ‘Necessary’ cookies. If the user does not make a choice on the categories of cookie and clicks save, the pop-up will automatically keep the slider on OFF. There is no way inaction on behalf of the user will ever show as consent given for the use of cookies, when you use CookieScan
- Cookie walls: The Guidelines no longer imposes a general and absolute ban on ‘cookie walls.’ However, the CNIL considers that this practice is likely to affect freedom of consent in certain cases, and the lawfulness of the practice must be assessed on a case-by-case basis. Further, if a ‘cookie wall’ is implemented, users must be clearly informed of the consequences of their choices, in particular the inability to access the content of the site or app or the service if they do not give consent.
Next Steps
The CNIL will allow for a transition period of six months to comply with the new cookie law rules (i.e., until the end of March 2021). The CNIL will carry out inspections to enforce the Guidelines after that transition period. However, in accordance with the case law of the Conseil d’Etat, the CNIL reserves the right to take action against certain infringements, in particular in case of particularly serious infringements of the right to privacy. In addition, during the transition period, the CNIL will continue to investigate infringements of the previous cookie law rules.
View original article from HUNTON Andrews Kurth here.