France’s Highest Administrative Court (the “Conseil d'Etat”) has just issued its decision on the guidelines on cookies and other tracking devices ("cookies") adopted by the CNIL on July 4, 2019 (the "guidelines"), following an action for annulment brought by various trade unions and professional associations in the advertising, e-commerce and media sectors.
The Conseil d'Etat considers that the CNIL cannot proceed in this way: "by inferring such a ban from the sole requirement of the user's freely given consent to the use of tracking devices, as imposed by the GDPR, the CNIL has exceeded what it could legally do in a so-called soft law instrument".
Thus, the Conseil d'Etat considered that such a general and absolute ban cannot be imposed in a soft law instrument like these guidelines. It therefore condemns the relevant paragraph of the guidelines.
With regard to the other claims, the Conseil d’Etat rejects the claimants' arguments.
In a context where administrative authorities are increasingly using soft law instruments (recommendations, guidelines or guidance, charters or codes, opinions, etc.), the decision issued by the Conseil d’Etat serves as a warning. However, it should be noted that the Conseil d'Etat does not rule on whether "cookies walls" are lawful or not on the merits, but rather rules on the adequacy of the instrument used by the CNIL to infer and enact such a ban, as allowed in an action for abuse of power.
On the same day the Conseil d'Etat published its decision, the CNIL issued a press release. The CNIL stated that it took note of the Conseil d'Etat's decision and intends to amend its guidelines accordingly, to the extent strictly necessary.
The revision of the guidelines and the adoption of future recommendations on this subject will not take place before September 2020.