Cookies: Clarification In France Of The Position Of The CNIL Through Three Major Decisions Impacting Worldwide Online Service Providers

• Published date: 11 January 2021
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Reed Smith (Worldwide)
• Author: Mr Daniel Kadar, Stéphanie Abdesselam and Laetitia Gaillard

In less than a month, the French data protection authority (CNIL) rendered three major decisions1 impacting worldwide online service providers following online controls and investigations performed on the companies' websites. In a nutshell, the decisions highlight the obligations of data controllers when using cookies and other trackers, notably regarding the way the user's consent shall be collected, and the level of information that has to be provided to users. Companies have an interest to closely watch and adapt their cookie compliance through the monitoring of the specific French requirements. The CNIL has recently announced it would grant a period of 6 months to implement the new CNIL guidelines i.e., data controllers are required to comply with these new guidelines by the beginning of April 2021. That time period should be actively used.

Cookie compliance is therefore a matter of urgency for any online business actors covering the French market and must be taken seriously considering the cross border penalties involved. Companies applying advertising cookies and other trackers should be fully aware of these practical recommendations when implementing their consent mechanisms and drafting the information wording aimed at users, ensuring to keep evidence of consent collection etc.

The penalties attached to these decisions are the largest ever imposed by the CNIL since the entry into force of the General Data Protection Regulation (GDPR). With these decisions, the CNIL is displaying its enforcement capabilities to companies all over the world, whatever their nationality and sector of activity.

A shift in the CNIL's approach, from prevention towards enforcement

The three decisions are consistent with the new doctrine developed by the CNIL since 2019. The CNIL showed its willingness to use its fining power to sanction practices related to the collection and use of personal data for advertising purposes,² it considers in breach of applicable regulation. The shift operated by the CNIL is that it now may decide to move on to a sanctions procedure - even if the targeted companies have previously taken some corrective measures, if the alleged deviation/breach is regarded to be material in view of the sufficient period of time since which the relevant requirements have been in force.

Cookie compliance has undeniably grown one of the CNIL's main concerns in that regard.

The decisions also reflect a strengthening of the CNIL's position regarding the enforcement...