The French Data Protection Authority (the CNIL) has made targeted online advertising a priority topic in its 2019-2020 agenda and has changed its position on cookie consent. Although the ePrivacy Regulation is still being debated by EU legislators and is far from being finalised, the CNIL has withdrawn its 2013 cookie recommendation and announced that it will publish new guidelines (announcements are available in English on the CNIL’s website here and here). These explicitly rule out the use of implied or “soft” consent to place cookies on users’ devices.
The CNIL will issue its guidance in two phases:
- it will publish its new guidelines on cookies in July 2019; and
- between July and November 2019, it will work alongside industry groups and other stakeholders (advertisers, adtech intermediaries, publishers etc.) to finalize its recommendations (including on practical mechanisms for obtaining consent).
The final recommendations will be released by January 2020 and organizations will have six months (until June 2020) to achieve compliance. The exact content of the guidelines is as yet unknown, but an active expression of consent will almost certainly be required before cookies can be placed.
This means that the CNIL is effectively offering a 12-month transition period to stakeholders. During this transition period, consent should still be regarded as valid if website users decided to keep browsing after a cookie banner is displayed to them. The CNIL will continue to investigate complaints and, if necessary, check, among other things, that no cookies are placed before ‘consent’ is obtained. From June 2020, however, implied or “soft” consent will no longer be accepted.