Home Privacy The CNIL Can’t Legally Forbid Cookie Walls Under GDPR

The CNIL Can’t Legally Forbid Cookie Walls Under GDPR

SHARE:

France’s highest administrative court has ruled that the country’s data protection authority does not have the right to ban cookie walls.

Cookie walls are pop-up notices that restrict access to a website until a visitor agrees to accept cookie tracking.

The Conseil d’État, a division of the French government that serves as its supreme court of administrative justice, issued a ruling on Friday in response to litigation initiated last year by French trade organizations. [Click here to read the ruling in French.]

The win is significant for publishers and ad tech companies, which will be able to continue offering free content in exchange for advertising, said Nicolas Rieul, president of IAB France and VP of the Mobile Marketing Association in France.

As long as consumers are given multiple options for accessing content – for example, the choice between cookie tracking, a paywall or registering for free with an email – consent is considered freely given and valid. Basically: pay, leave or personalize, the choice is up to you, but there has to be a choice. This is considered a balanced approach to privacy as called for under the GDPR.

“It’s very important news for the monetization of the free and open internet,” Rieul said.

Backstory

The original complaint zeroed in on a near-final draft of consent guidelines for cookies and other trackers released by the Commission nationale de l’informatique et des libertés (the CNIL) in July 2019.

The purpose of the new guidelines is to bring the CNIL’s stance on tracking, which hadn’t been updated since 2013, in line with the General Data Protection Regulation.

According to the Conseil d’État’s ruling, however, one of the CNIL’s recommendations exceeded what was called for under GDPR, namely prohibiting publishers from blocking access to content when a user doesn’t consent to cookie tracking in cases where the user is also presented with other alternatives.

Companies are still bound by all of the data protection tenets under GDPR, including needing legitimate interest or consent to process data.

Subscribe

AdExchanger Daily

Get our editors’ roundup delivered to your inbox every weekday.

“Cookie walls aren’t a free pass for publishers to do whatever they want with personal data,” said Mathieu Roche, CEO and co-founder of identity company ID5. “Customers still have a right to transparency, choice and control to customize the type of data they are willing to share and the purpose for which their data can be used.”

By the same token, publishers need a means to compete for ad dollars, especially against Google, Facebook and other platform companies.

“Stripping them of the ability to collect user data – which the walled gardens are doing at a much greater scale – would be like sending them to a gunfight armed with a knife,” Roche said.

Parlez-vous

Although it was good to get clarity on the cookie wall question, there are wider ramifications of the outcome in this case that go “far beyond just the question of cookies,” said Etienne Drouard, a partner at Hogan Lovells in Paris and the lawyer who represented the French trade orgs in their joint complaint to the Conseil d’État against the CNIL.

The ad industry now has the opportunity to initiate a fresh round of conversations and consultations with the CNIL, whose regulators aren’t always all that open to discussion.

“I wouldn’t use the word ‘negotiation,’ because you don’t negotiate with a public authority like the CNIL,” Drouard said. “The door is open, however, to start a new set of discussions.”

Going forward, the CNIL will have to adapt the final draft of its cookie recommendations to reflect the Conseil d’État’s decision. The draft is expected to be published in September followed by a six-month transition period for businesses and publishers to adapt.

The final guidelines, which include the elimination of tacit or scrolling consent and the requirement that consent be specific to the stated purpose, should be in force by March 2021.

In their complaint, the trade orgs had also tried to argue for the ability to bundle multiple comparable purposes together. They lost on that point, although publishers are still allowed to present users with the option to provide a single consent for all purposes.

Patchwork

But there’s still a question of what the Conseil d’État’s position means in the wider European context.

Rather than referring this case to the European Court of Justice, which is the supreme court of the EU, the Conseil d’État decided to judge the case itself, which means the result isn’t an EU-wide opinion.

Other data protection authorities in the EU have different points of view on the viability of cookie walls, or the lack thereof.

Data regulators in Austria, for example, have said that a cookie wall is OK if visitors to a site are presented with a degree of choice, while the data protection authority in the Netherlands issued guidance prohibiting the use of cookie walls. There are still many differences between how various member states interpret the GDPR.

“We urgently need harmonization,” Rieul said.

Must Read

How Should Advertisers Navigate A TikTok Ban Or Google Breakup? Just Ask Brian Wieser

The online advertising industry is staring down the barrel of not one but two potential shutdowns that could radically change where brands put their ad dollars in 2025, according to Madison and Wall’s Brian Weiser and Olivia Morley.

Intent IQ Has Patents For Ad Tech’s Most Basic Functions – And It’s Not Afraid To Use Them

An unusual dilemma has programmatic vendors and ad tech platforms worried about a flurry of potential patent infringement suits.

TikTok Video For Open Web Publishers? Outbrain Built It.

Outbrain is trying to shed its chumbox rep by bringing social media-style vertical video to mobile publishers on the open web.

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters

Billups Launches Attention Measurement For Out-Of-Home

Billups, a managed services agency that specializes in OOH, is making its attention measurement solution and a related analytics dashboard available for general use.

US District Court for the Eastern District of Virginia, Alexandria

The Google Ad Tech Antitrust Case Is Over – And Here’s What’s Happening Next

Just three weeks after it began, the Google ad tech antitrust trial in Virginia is over. The court will now take a nearly two-month break before reconvening for closing arguments right before Thanksgiving.

Jounce Media's Chris Kane at Programmatic IO NY on Sept. 25, 2024.

The Bidstream Is A Duplicative, Chaotic Mess – But It Doesn’t Have To Be That Way

Publishers are initiating more and more auctions – but doesn’t mean DSPs are listening to more bids, according to Chris Kane.