Following the recent decision of the Conseil d’État concerning CNIL Deliberation No. 2019-093 on the deposit of cookies, a point on the state of the law – and on the obligations incumbent on companies – is necessary.
The latest publications and the position of the CNIL
On 4 May 2020, the EDPB (European Data Protection Board) Guidelines clarified an earlier position from April 2018 on the validity of consent in relation to cookies, which was largely taken up by the CNIL in its Deliberation 2019-093, debated on 19 June before the Conseil d’État.
The EDPB points out that a “cookie wall” is incompatible with free consent because it does not offer a choice to the Internet user (freedom being a condition for the validity of the consent according to the GDPR). Indeed, an Internet user wishing to access the service would indeed have no choice but to accept cookies or to give up access to the content of the site.
The decision of the Conseil d’Etat: semi-victory for online sales professionals?
On 19 June 2020, the Conseil d’Etat issued a decision on CNIL Deliberation No 2019-093, inspired by the position of the EDPB. Unsurprisingly, it validated the majority of the CNIL’s recommendations regarding the deposit of cookies and the collection of consent. With regard to “cookie walls”, it considered that the GDPR does not prevent a website publisher from refusing to display the content of the site when the user has not accepted the cookies.
What are the consequences?
Concerning the obligations incumbent on companies today in terms of cookies following this news, the CNIL’s Deliberation No. 2019-093, for which the CNIL had decided to grant a 12-month compliance period, is thus validated for the majority of its provisions. There is no doubt that the CNIL compliance checks for this deliberation could begin as soon as September 2020.
We strongly recommend that French companies prepare for a possible CNIL audit of their website, by complying with Deliberation 2019-093, both in terms of the cookie banner and the collection and proof of consent, as well as the information provided to visitors via their privacy policy.