France’s highest administrative court has ruled that the country’s data protection authority does not have the right to ban cookie walls.
Cookie walls are pop-up notices that restrict access to a website until a visitor agrees to accept cookie tracking.
The Conseil d’État, a division of the French government that serves as its supreme court of administrative justice, issued a ruling on Friday in response to litigation initiated last year by French trade organizations. [Click here to read the ruling in French.]
The win is significant for publishers and ad tech companies, which will be able to continue offering free content in exchange for advertising, said Nicolas Rieul, president of IAB France and VP of the Mobile Marketing Association in France.
As long as consumers are given multiple options for accessing content – for example, the choice between cookie tracking, a paywall or registering for free with an email – consent is considered freely given and valid. Basically: pay, leave or personalize, the choice is up to you, but there has to be a choice. This is considered a balanced approach to privacy as called for under the GDPR.
“It’s very important news for the monetization of the free and open internet,” Rieul said.
Backstory
The original complaint zeroed in on a near-final draft of consent guidelines for cookies and other trackers released by the Commission nationale de l’informatique et des libertés (the CNIL) in July 2019.
The purpose of the new guidelines is to bring the CNIL’s stance on tracking, which hadn’t been updated since 2013, in line with the General Data Protection Regulation.
According to the Conseil d’État’s ruling, however, one of the CNIL’s recommendations exceeded what was called for under GDPR, namely prohibiting publishers from blocking access to content when a user doesn’t consent to cookie tracking in cases where the user is also presented with other alternatives.
Companies are still bound by all of the data protection tenets under GDPR, including needing legitimate interest or consent to process data.
“Cookie walls aren’t a free pass for publishers to do whatever they want with personal data,” said Mathieu Roche, CEO and co-founder of identity company ID5. “Customers still have a right to transparency, choice and control to customize the type of data they are willing to share and the purpose for which their data can be used.”
By the same token, publishers need a means to compete for ad dollars, especially against Google, Facebook and other platform companies.
“Stripping them of the ability to collect user data – which the walled gardens are doing at a much greater scale – would be like sending them to a gunfight armed with a knife,” Roche said.
Parlez-vous
Although it was good to get clarity on the cookie wall question, there are wider ramifications of the outcome in this case that go “far beyond just the question of cookies,” said Etienne Drouard, a partner at Hogan Lovells in Paris and the lawyer who represented the French trade orgs in their joint complaint to the Conseil d’État against the CNIL.
The ad industry now has the opportunity to initiate a fresh round of conversations and consultations with the CNIL, whose regulators aren’t always all that open to discussion.
“I wouldn’t use the word ‘negotiation,’ because you don’t negotiate with a public authority like the CNIL,” Drouard said. “The door is open, however, to start a new set of discussions.”
Going forward, the CNIL will have to adapt the final draft of its cookie recommendations to reflect the Conseil d’État’s decision. The draft is expected to be published in September followed by a six-month transition period for businesses and publishers to adapt.
The final guidelines, which include the elimination of tacit or scrolling consent and the requirement that consent be specific to the stated purpose, should be in force by March 2021.
In their complaint, the trade orgs had also tried to argue for the ability to bundle multiple comparable purposes together. They lost on that point, although publishers are still allowed to present users with the option to provide a single consent for all purposes.
Patchwork
But there’s still a question of what the Conseil d’État’s position means in the wider European context.
Rather than referring this case to the European Court of Justice, which is the supreme court of the EU, the Conseil d’État decided to judge the case itself, which means the result isn’t an EU-wide opinion.
Other data protection authorities in the EU have different points of view on the viability of cookie walls, or the lack thereof.
Data regulators in Austria, for example, have said that a cookie wall is OK if visitors to a site are presented with a degree of choice, while the data protection authority in the Netherlands issued guidance prohibiting the use of cookie walls. There are still many differences between how various member states interpret the GDPR.
“We urgently need harmonization,” Rieul said.
