Are you a publisher of websites and/or mobile applications, or an advertising agency or website designer? Then you are concerned by these recommendations from the National Commission for Information Technology and Liberties (CNIL). The CNIL adopted in September 2020 (and published in the Official Journal in October 2020), new recommendations (no. 2020-092), on the practical methods of compliance of “cookies” and other “trackers”. The CNIL has already announced that it could pursue breaches of these recommendations, particularly in the event of a particularly serious violation of the right to respect for private life.
Operations affected by the new CNIL compliance rules:
“All operations aimed at accessing, by means of electronic transmission, information already stored in the terminal equipment of the subscriber or user of an electronic communications service or at entering information therein”
Included in recommendations
| cookies that monitor end user actions: |
| « cookies html”, but also other commonly used plotters: ” Flash cookie », « local storage », « fingerprinting », |
| hardware identifiers or generated by operating systems…, |
| cookies linked to operations relating to personalized advertising, |
| social media cookies, |
| etc. |
These cookies require the user to give consent free, specific, lit, unambiguous.
Exempt from collecting consent
| Cookies retaining interface customization choices (language or service presentation preferences), |
| Cookies intended for user authentication and the security of this authentication, |
| Cookies aimed at storing the shopping cart in memory, but also those aimed at billing the services or products purchased, |
Processing of personal data collected or produced via a tracker, constituting processing of personal data, is subject to the provisions of the GDPR.
Cookie Consent must be…
| Prerequisite | • No cookie can be placed or read on the user’s terminal, until the latter has given his consent. |
| Univocal | • The user must consent to the deposit of tracers by clear positive action (click on “ I accept ” in a cookie banner, or activation of switches). If he does not do so, no tracer not essential to the operation of the service may be placed on his device. |
| Free | • No obligation to accept, record, or read cookies on their terminal cannot be imposed on the user (in order to have access to the service or the website) • 1 consent = 1 purpose; |
| Lit | • Clear information (in simple and clear terms, and with a design understandable by everyone), of the purposes and consequences of accepting cookies must be given to the user |
Refusal of cookies must be…
| Possible | • It should be this simple to refuse cookies rather than accepting them upon connection by the Internet user. • Refusal cannot be subject to conditions. |
Withdrawal of consent must be…
| Simple | • It should be this simple to withdraw consent than giving it, The options for withdrawing consent must be in an easily accessible place and at all times. • A simple and clear information, must be given to the user regarding the solutions made available to them to withdraw their consent (e.g. via an accessible link “manage my cookies” or “cookies”) |
| Sanctions | • In May 2021, after verification, the CNIL issued formal notice to around thirty digital companies with non-compliant practices on cookies. Consequence: 1 month to comply; failing which they incur a sanction = 2% of their turnover • December 2020: 2 significant sanctions for non-compliant cookie practices against: Google: 100 million euros fine Amazon: 35 million euros fine |
Article published on July 26, 2021. Its content reflects the context of its publication.
A question about your situation? Contact the firm ↗
