By Mathieu GAUDEMET, Romain SOIRON et Delphine GASNE FRYE
The French data protection authority (CNIL) recently shared its priorities for the year 2021 and announced the reinforcement of controls on compliance with the rules applicable to cookies. More specifically, from April 2021, the CNIL plans to extend its controls to verify compliance with the rules for obtaining consent.
As a reminder, Article 82 of the French data protection act transposes Article 5.3 of the ePrivacy Directive into French law and provides for the obligation to obtain the consent of Internet users prior to any writing or reading of cookies. On this basis, the CNIL has adopted new guidelines and recommendations on the use of cookies.
Although some are exempt, most cookies require the prior consent of the Internet user.
When consent is required, it must be obtained prior to the deposit and/or reading of cookies and must be free, specific, unambiguous, informed, and manifested by a statement or by a clear positive act. The Internet user must be able to withdraw consent at any time.
Among the cookies that do not require prior consent, web analytics tools receive special attention. Although their use is widely spread, it is necessary to use them with caution because the exemption is limited. Indeed, web analytics tools can only be exempted if their use is limited to measuring the website’s audience exclusively for the website publisher and if the statistical data remain anonymous. Thus, when the data are transferred to a third party or when the cookies allow the global tracking of the user’s navigation, it is no longer possible to benefit from the exemption. It is therefore necessary to obtain the Internet user’s consent.
Our firm closely monitors CNIL issues and assists all its clients in their compliance process. We can, for example, produce a report on the existing situation and create an operational document for webmasters so that they can make the necessary adaptations to comply with the legal requirements.