Home Privacy The CNIL Can’t Legally Forbid Cookie Walls Under GDPR

The CNIL Can’t Legally Forbid Cookie Walls Under GDPR


France’s highest administrative court has ruled that the country’s data protection authority does not have the right to ban cookie walls.

Cookie walls are pop-up notices that restrict access to a website until a visitor agrees to accept cookie tracking.

The Conseil d’État, a division of the French government that serves as its supreme court of administrative justice, issued a ruling on Friday in response to litigation initiated last year by French trade organizations. [Click here to read the ruling in French.]

The win is significant for publishers and ad tech companies, which will be able to continue offering free content in exchange for advertising, said Nicolas Rieul, president of IAB France and VP of the Mobile Marketing Association in France.

As long as consumers are given multiple options for accessing content – for example, the choice between cookie tracking, a paywall or registering for free with an email – consent is considered freely given and valid. Basically: pay, leave or personalize, the choice is up to you, but there has to be a choice. This is considered a balanced approach to privacy as called for under the GDPR.

“It’s very important news for the monetization of the free and open internet,” Rieul said.


The original complaint zeroed in on a near-final draft of consent guidelines for cookies and other trackers released by the Commission nationale de l’informatique et des libertés (the CNIL) in July 2019.

The purpose of the new guidelines is to bring the CNIL’s stance on tracking, which hadn’t been updated since 2013, in line with the General Data Protection Regulation.

According to the Conseil d’État’s ruling, however, one of the CNIL’s recommendations exceeded what was called for under GDPR, namely prohibiting publishers from blocking access to content when a user doesn’t consent to cookie tracking in cases where the user is also presented with other alternatives.

Companies are still bound by all of the data protection tenets under GDPR, including needing legitimate interest or consent to process data.


AdExchanger Daily

Get our editors’ roundup delivered to your inbox every weekday.

“Cookie walls aren’t a free pass for publishers to do whatever they want with personal data,” said Mathieu Roche, CEO and co-founder of identity company ID5. “Customers still have a right to transparency, choice and control to customize the type of data they are willing to share and the purpose for which their data can be used.”

By the same token, publishers need a means to compete for ad dollars, especially against Google, Facebook and other platform companies.

“Stripping them of the ability to collect user data – which the walled gardens are doing at a much greater scale – would be like sending them to a gunfight armed with a knife,” Roche said.


Although it was good to get clarity on the cookie wall question, there are wider ramifications of the outcome in this case that go “far beyond just the question of cookies,” said Etienne Drouard, a partner at Hogan Lovells in Paris and the lawyer who represented the French trade orgs in their joint complaint to the Conseil d’État against the CNIL.

The ad industry now has the opportunity to initiate a fresh round of conversations and consultations with the CNIL, whose regulators aren’t always all that open to discussion.

“I wouldn’t use the word ‘negotiation,’ because you don’t negotiate with a public authority like the CNIL,” Drouard said. “The door is open, however, to start a new set of discussions.”

Going forward, the CNIL will have to adapt the final draft of its cookie recommendations to reflect the Conseil d’État’s decision. The draft is expected to be published in September followed by a six-month transition period for businesses and publishers to adapt.

The final guidelines, which include the elimination of tacit or scrolling consent and the requirement that consent be specific to the stated purpose, should be in force by March 2021.

In their complaint, the trade orgs had also tried to argue for the ability to bundle multiple comparable purposes together. They lost on that point, although publishers are still allowed to present users with the option to provide a single consent for all purposes.


But there’s still a question of what the Conseil d’État’s position means in the wider European context.

Rather than referring this case to the European Court of Justice, which is the supreme court of the EU, the Conseil d’État decided to judge the case itself, which means the result isn’t an EU-wide opinion.

Other data protection authorities in the EU have different points of view on the viability of cookie walls, or the lack thereof.

Data regulators in Austria, for example, have said that a cookie wall is OK if visitors to a site are presented with a degree of choice, while the data protection authority in the Netherlands issued guidance prohibiting the use of cookie walls. There are still many differences between how various member states interpret the GDPR.

“We urgently need harmonization,” Rieul said.

Must Read

Comic: TFW Disney+ Goes AVOD

Disney Expands Its Audience Graph And Clean Room Tech Beyond The US

Disney expands its audience graph and clean room tech to Latin America, marking the first time it will be available outside the US. The announcement precedes this week’s launch of Disney+ with ads in Latin America.

Advertible Makes Its Case To SSPs For Running Native Channel Extensions

Companies like TripleLift that created the programmatic native category are now in their awkward tween years. Cue Advertible, a “native-as-a-service” programmatic vendor, as put by co-founder and CEO Tom Anderson.

Mozilla acquires Anonym

Mozilla Acquires Anonym, A Privacy Tech Startup Founded By Two Top Former Meta Execs

Two years after leaving Meta to launch their own privacy-focused ad measurement startup in 2022, Graham Mudd and Brad Smallwood have sold their company to Mozilla.

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters

Nope, We Haven’t Hit Peak Retail Media Yet

The move from in-store to digital shopper marketing continues, as United Airlines, Costco, PayPal, Chase and Expedia make new retail media plays. Plus: what the DSP Madhive saw in advertising sales software company Frequence.

Comic: Ad-ception

The New York Times And Instacart Integrate For Shoppable Recipes

The New York Times and Instacart are partnering for shoppable recipe videos.

Experian Enters The Third-Party Data Onboarding Business

Experian entered the third-party data onboarder market on Tuesday with a new product based on its Tapad acquisition.