On October 1, 2020, the French Data Protection Authority (the “CNIL”) published a revised version of its guidelines on cookies and similar technologies (the “Guidelines”), its final recommendations on the practical modalities for obtaining users’ consent to store or read non-essential cookies and similar technologies on their devices (the “Recommendations”) and a set of questions and answers on the Recommendations (“FAQs”).
CNIL’s Guidelines and Recommendations on Cookies
Key takeaways from the new Guidelines and Recommendations include:
- Users’ consent to be obtained on each site: The CNIL previously considered that it was acceptable to seek users’ consent for a group of sites if users were informed of the exact scope of their consent. The CNIL now strongly recommends seeking users’ consent individually for each site, when non-essential cookies are set by other entities than the web publisher and those cookies enable tracking of users’ activities through other sites.
CookieScan will scan your site on a regular basis to identify new cookies and remove any inactive ones. You can be confident that CookieScan will keep you up-to-date and compliant with the cookie requirements of the law.
CookieScan provides information to the users about the purpose of each cookie in the selected category in an easy to understand language.
- Users’ refusal deduced from their silence:The CNIL previously recognized the possibility for users to delay their choice, and recommended inserting a “cross” button in the consent interface to that end. The CNIL now considers that users’ silence, inaction or action (other than a clear positive act expressing their consent) must be interpreted as a refusal to have cookie set on their devices.
- Cookie walls: The Guidelines no longer imposes a general and absolute ban on ‘cookie walls.’ However, the CNIL considers that this practice is likely to affect freedom of consent in certain cases, and the lawfulness of the practice must be assessed on a case-by-case basis. Further, if a ‘cookie wall’ is implemented, users must be clearly informed of the consequences of their choices, in particular the inability to access the content of the site or app or the service if they do not give consent.
The CNIL will allow for a transition period of six months to comply with the new cookie law rules (i.e., until the end of March 2021). The CNIL will carry out inspections to enforce the Guidelines after that transition period. However, in accordance with the case law of the Conseil d’Etat, the CNIL reserves the right to take action against certain infringements, in particular in case of particularly serious infringements of the right to privacy. In addition, during the transition period, the CNIL will continue to investigate infringements of the previous cookie law rules.
View original article from HUNTON Andrews Kurth here.