In June 2019, the French data protection authority CNIL published its guidelines on the legally secure use of cookies. On June 19, 2020, the legality of the guidelines was confirmed by the French Council of State.
At the end of 2020, CNIL fined Google €100 million and Amazon €35 million for violations of the guidelines introduced in 2019. For 2021, the CNIL has announced stricter controls.
In April 2021, the adaptation period granted in the guidelines ends. The French guidelines should therefore be implemented by websites as soon as possible.
CNIL guidelines & expert recommendation
The CNIL's requirements for website operators are essentially the same as those of the GDPR.
Website operators must obtain the consent of their users before setting cookies that are not technically necessary and must be able to prove that they have obtained valid consent from the user.
Users must also be able to withdraw their consent as easily as they gave it. A valid cookie banner must inform what cookies a website uses, what data it collects, and who collects the data.
According to EPP attorney Vanina Vedel, the cookie banner must therefore contain the following information:
- Information about the identity of the responsible person(s)
- Purpose of the use of cookies
- Information about the right to withdraw consent
The consent itself must be specific, i.e. there must be consent for each use of the cookie. Simply scrolling or surfing on the website does not constitute consent. Pre-settings in the cookie selection are not permitted.
Usage purposes must be recognizable in the cookie banner, vague formulations will be sanctioned. The cookie banner must also be completed via a cookie charter (cookie settings).
Legality of cookie walls still unclear
The use of so-called "cookie walls", i.e. asking the user to accept cookies in order to use an online offer, was prohibited in the CNIL guidelines. However, the French Council of State deemed the CNIL guidelines on this point to be unlawful in its decision of June 19, 2020.
So whether the use of cookie walls is legal is still unclear. The question of cookie walls is currently also being debated at European level. Ms. Wedel therefore recommends not using cookie walls in France until the legal situation has been clarified.