Home Privacy French Regulators Gift Pubs With A One-Year Break Before They Need To Comply With New Cookie Consent Rules

French Regulators Gift Pubs With A One-Year Break Before They Need To Comply With New Cookie Consent Rules


France’s data protection authority is giving publishers until the spring of 2020 to design and deploy GDPR-compliant cookie consent notices.

Until then, scroll consent – aka, soft or tacit consent – will be acceptable.

At a meeting in late April, representatives from the Commission nationale de l’informatique et des libertés told French industry trade organizations about the reprieve and shared additional details about the CNIL’s agenda for the coming year.

The assembled trade orgs – which included IAB France, the French arm of the Mobile Marketing Association, publisher-focused group Geste and SNCD, France’s answer to the Direct Marketing Association – had requested the meeting in an urgent mid-March letter to newly appointed CNIL president, Marie-Laure Denis.

Several public formal notices issued over the past year by the CNIL have called out specific companies in the digital advertising sector for improperly collecting user consent. As a result, there’s been some clarification on how to comply consent wise, but there’s still confusion about exactly what’s required.

The CNIL’s first order of business is to update its 2013 consent recommendations, which are obsolete now that GDPR is on the scene.

Under the recs, as long as users are shown a banner that explains why cookies are being collected and then given an easy way to opt out, sites can drop cookies even if the only form of affirmative action on the part of visitors is to scroll on the page.

The commission is planning to release updated rules in June to bring its recommendations more in line with GDPR principles. Between June and November, the CNIL will work with industry groups to make sure the guidelines are practical. Finalized consent guidelines will be published in January 2020.

Companies will then have six months to get themselves sorted before the new guidelines will be enforced. In the meantime, the 2013 consent recs, which allow implied consent, will continue to apply.

The CNIL’s willingness to work with industry representatives appears to acknowledge the lack of clarity in the law as it stands.

Consent under GDPR needs to be affirmative, informed, specific, freely given and unambiguous. Preticked consent boxes or passively scrolling past a cookie notice doesn’t count as consent.


AdExchanger Daily

Get our editors’ roundup delivered to your inbox every weekday.

The CNIL’s existing 2013 guidelines, however, allow for passive consent as long as visitors are given clear information about the site’s cookie policy, usually in banner form, along with the opportunity to opt out of tracking. Most websites continue to operate in this way.

These now outdated guidelines were created with the ePrivacy Directive in mind, which ushered in all of those pop-up banners you see every time you hit a European website alerting you that simply by visiting the site you accept the use of cookies.

The ePrivacy Directive was meant to have been updated and replaced with an ePrivacy Regulation back when the GDPR was first coming into force in May of last year. That still hasn’t happened yet, which is partly why many data protection authorities, unlike the CNIL, have yet to take steps to update their country’s own outmoded cookie policies.

In a recent interview with French publication Journal Du Net, the CNIL’s secretary general, Jean Lessi, noted that, because the ePrivacy Regulation will likely not be finalized in 2019, there is “urgency” to update the commission’s stance on the use of cookies to bring it in line with GDPR.

The CNIL and IAB France did not respond in time for publication.

Must Read

Comic: Ad-ception

The New York Times And Instacart Integrate For Shoppable Recipes

The New York Times and Instacart are partnering for shoppable recipe videos.

Experian Enters The Third-Party Data Onboarding Business

Experian entered the third-party data onboarder market on Tuesday with a new product based on its Tapad acquisition.

Albertsons Takes Its First Steps Into Non-Endemic Advertising, Retail Media’s Next Frontier

Albertsons is taking that first step into non-endemic advertising next week via a partnership with Rokt to serve ads to people who have already purchased groceries.

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters

Marketecture Buys AdTechGod (No, Really)

Marketecture has acquired AdTechGod – an anonymous ad tech Twitter poster turned one-man content studio – and the AdTech Forum, an information resource hosted by AdTechGod and Jeremy Bloom.

Why The False Advertising Lawsuit Against Poppi Is Bad News For RMNs

This week’s dispatch explores the new trend of false advertising class-action suits in the food and CPG industry and how the evolution of online, data-driven retail media could exacerbate the problem.

Seedtag Acquires Beachfront For Deeper Roots In TV And Streaming

Contextual ad platform Seedtag acquires Beachfront, a supply-side platform that specializes in TV and video.