Explore our collection of PDF documents and enrich your knowledge now!
back
"Cookie walls" - the French Conseil d'Etat invalidates part of the CNIL's guidelines on cookies and other tracking devices
Article IT and Data Protection Competition, Retail and Consumer Law Commercial and International Contracts | 24/06/20 | 4 min. | Roxane Blanc-Dubois Florence Chafiol Alice Hourquebie
Protection des données personnelles
France’s Highest Administrative Court (the “Conseil d'Etat”) has just issued its decision on the guidelines on cookies and other tracking devices ("cookies") adopted by the CNIL on July 4, 2019 (the "guidelines"), following an action for annulment brought by various trade unions and professional associations in the advertising, e-commerce and media sectors.
As a reminder, the purpose of these guidelines is to specify (i) the rules stemming from the General Data Protection Regulation ("GDPR") regarding the collection of consent to the use of cookies and (ii) the best practices on this subject since the entry into force of the GDPR.
The aforementioned claimants challenged, in particular, the ban imposed by the CNIL’s guidelines on the use of the so-called "cookies walls". This practice consists in denying access to a website or mobile app if the Internet user does not consent to the tracking of his or her browsing activity through the use of cookies.
As a basis for this ban, the CNIL indicated in its guidelines, with regard to the need for freely given consent, that such consent can only be valid if the user is able to validly exercise his or her choice and does not suffer major inconvenience in the event he or she does not consent or withdraw consent to the use of cookies. In this respect, the CNIL considered that access to a website or a mobile app should never be made conditional upon the acceptance of cookies (ban on "cookies walls"). In this respect, the CNIL endorsed the position of the European Data Protection Board (EDPB) on the issue.
The Conseil d'Etat considers that the CNIL cannot proceed in this way: "by inferring such a ban from the sole requirement of the user's freely given consent to the use of tracking devices, as imposed by the GDPR, the CNIL has exceeded what it could legally do in a so-called soft law instrument".
Thus, the Conseil d'Etat considered that such a general and absolute ban cannot be imposed in a soft law instrument like these guidelines. It therefore condemns the relevant paragraph of the guidelines.
With regard to the other claims, the Conseil d’Etat rejects the claimants' arguments.
In a context where administrative authorities are increasingly using soft law instruments (recommendations, guidelines or guidance, charters or codes, opinions, etc.), the decision issued by the Conseil d’Etat serves as a warning. However, it should be noted that the Conseil d'Etat does not rule on whether "cookies walls" are lawful or not on the merits, but rather rules on the adequacy of the instrument used by the CNIL to infer and enact such a ban, as allowed in an action for abuse of power.
On the same day the Conseil d'Etat published its decision, the CNIL issued a press release. The CNIL stated that it took note of the Conseil d'Etat's decision and intends to amend its guidelines accordingly, to the extent strictly necessary.
The revision of the guidelines and the adoption of future recommendations on this subject will not take place before September 2020.
Useful links
Decision issued by the Conseil d’Etat No. 434684 dated 19 June 2020 (in French)
CNIL’s press release dated 19 June 2020 regarding the decision issued by the Conseil d’Etat (in French)
CNIL’s guidelines dated 4 July 2019 on cookies and other tracking devices (in French)