The French Data Protection Authority Releases A Recommendation On Cookies

Author:Ms Laure Marolleau
Profession:Soulier Avocats

As part of its action plan on targeted advertisement, the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés or "CNIL") is proposing a consultation on a draft recommendation on practical procedures for collecting user consent for the use of online trackers1.

Following the guidelines recalling the legal provisions that govern the use of cookies and other trackers adopted on July 4, 20192, the CNIL conducted a consultation during the fall of 2019, in order to prepare a draft recommendation proposing operational procedures for obtaining consent. This draft is now subject to public consultation until February 25, 2020. At the end of this period, a final version of the recommendation will be presented for final adoption.

Adaptation to applicable law

The application of the General Data Protection Regulation3 ("GDPR") has strengthened the requirements for the validity of consent. The mere continuation of navigation on a website can no longer be regarded as a valid expression of consent to the use of cookies, which must now be the result of an unambiguous positive action on the part of the Internet user. Furthermore, the GDPR expressly provides that actors must be able to prove that they have indeed obtained valid consent from Internet users.

As the risk associated with obtaining consent is quite significant (the GDPR provides for the possibility of imposing on non-compliant companies heavy fines of up to 4% of their annual turnover), the CNIL announced an action plan to align its recommendations with the new rules on consent governing the use of cookies and other trackers for audience measurement, user profiling and targeted advertisement.

The recommendation is not intended to be prescriptive. Its main purpose is to provide practical examples for the implementation of the regulations. Some of these examples are addressed below.

Consent collection

Informed consent: The purpose(s) of the trackers must be presented to the Internet user before he/she is given the opportunity to consent or not to consent to their use.

The Internet user must be able to find out the identity of all those responsible for the processing operation(s) before being able to give consent or to refuse to give consent.

Free consent: Consent can only be valid if the Internet user is able to exercise his/her choice freely, under the conditions described in the guidelines.

In practice, a request for consent could take the form of boxes that...

To continue reading