The CNIL and the online marketing and web profiling sector – an update

The French data protection authority (the CNIL) has announced that it will soon communicate to data controllers a clarification of the legal obligations in terms of obtaining consent for cookies, as well as all for all other tracking devices and techniques.

Updated cookie consent recommendation

In 2018, around 20% of the complaints received by the CNIL were related to marketing in the broad sense. Meanwhile, the online marketing and web profiling sector is seeking to better comprehend its obligations under applicable data protection legislation.

More precisely, the online marketing sector is subject to two regulations that impose strict conditions, in particular for what concerns consent:

• (i) the GDPR, and
• (ii) national regulations transposing the 2002 Directive, amended in 2009, concerning the processing of personal data and the protection of privacy in electronic communications.

The 2002 Directive is also known as the ePrivacy Directive, whereas the 2009 update is sometimes colloquially referred to as the Cookies Directive.

The CNIL has now communicated to the public that it will make targeted online advertising a priority topic for 2019. Since its 2013 cookie recommendation is now outdated, in particular with respect to the expression of consent, it intends to update in July of this year its recommendation to align it with the guidelines of the European Data Protection Board (EDPB) and with the above-mentioned data protection legislation. By doing so, the CNIL will not wait for the adoption of the ePrivacy Regulation, which is currently under discussion and which will not come into force in the short term.

Transition period

The EDPB has explicitly excluded in its guidelines on consent the scrolling down or swiping through a website or application as a valid expression of consent. As an alternative, a greater emphasis would be put on the use of cookie management modules, which are arguably more granular than cookie banners in expressing consent.

However, the CNIL communicated that it will allow a transit period of 1 year, so that stakeholders have the time to comply with the principles that diverge from the previous recommendation. During this period, the CNIL will still accept the scrolling down or swiping through a website or application.

To be continued...