DATA PROTECTION
The French CNIL publishes criteria for assessing legality of cookie walls.
The French data protection authority ('CNIL') published guidance outlining criteria for assessing the legality of cookie walls, i.e. the practice of conditioning access to a service on the internet user's consent to the deposit of cookies or similar tracking technologies on their terminal device.
In particular, the guidance follows the Council of State's decision of 19 June 2020 whereby it ruled that CNIL could not impose a blanket ban on the use of cookie walls, as it had intended in its draft guidelines on cookies and similar trackers, which consequently do not generally prohibit such practices in their final effective version. Nonetheless, the new guidance issued by CNIL highlights that if the requirement of 'free' consent under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') does not lead to a general ban on the practice of cookie walls, their legality must be assessed taking into account in particular the existence of real and satisfactory alternatives offered in the event of users refusing the deposit of cookies on their terminal devices.
A real and fair alternative to walled content or services
More specifically, CNIL outlined, as a first criterion for ensuring that cookie walls do not contradict the requirement of freedom of consent, that, either:
Additionally, CNIL further specifies that such imbalance may arise in the event of exclusivity of the publisher on the content or services offered, or when the user has few or no alternatives to the service and therefore has no real choice as to the use of cookies, for example in the case of dominant or essential service providers.
'Reasonable' paywall price
In the first case, CNIL outlined that offering a paid alternative (i.e. requiring either the acceptance of cookies or remuneration for the services provided) is not prohibited in practice. However, CNIL stipulated that the price must be reasonable, i.e. not so high as to deprive users of a real choice. As opposed to setting out specific thresholds, CNIL noted that the determination of what is 'reasonable' is subject to a case-by-case analysis, further outlining that those wishing to implement a paywall must be able to justify the reasonableness of the monetary consideration offered. In addition, CNIL recommended that, for the purpose of transparency, such analysis should be published.
Limiting of cookie wall purposes
Additionally, CNIL highlighted that where cookie walls are implemented, the publisher must demonstrate that it is limited to the purposes which allow fair remuneration for the service offered. To illustrate this requirement, the guidance provides that if a publisher considers that the remuneration for its service depends on the income it could obtain from targeted advertising, only consent for this purpose should be necessary to access the service; the refusal to consent to other purposes should not prevent access to the content of the site.
Deposit of cookies where cookie wall alternative is selected
Further to the above, CNIL stipulated that, as a general rule, where the user chooses the publisher's alternative to the cookie wall, no cookies or similar trackers should be deposited by the publisher, with the exception of those strictly necessary for the provision of the requested service. However, as a further exception, CNIL noted that publishers may request, on a case-by-case basis, the user's consent to the deposit of cookies or similar trackers when the latter are required to access content hosted on a third-party site (e.g. to view a video hosted by a third-party site), provided that the required information is made available to users, including:
In particular, the guidance follows the Council of State's decision of 19 June 2020 whereby it ruled that CNIL could not impose a blanket ban on the use of cookie walls, as it had intended in its draft guidelines on cookies and similar trackers, which consequently do not generally prohibit such practices in their final effective version. Nonetheless, the new guidance issued by CNIL highlights that if the requirement of 'free' consent under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') does not lead to a general ban on the practice of cookie walls, their legality must be assessed taking into account in particular the existence of real and satisfactory alternatives offered in the event of users refusing the deposit of cookies on their terminal devices.
A real and fair alternative to walled content or services
More specifically, CNIL outlined, as a first criterion for ensuring that cookie walls do not contradict the requirement of freedom of consent, that, either:
- the publisher must offer a real and fair alternative allowing access to the site and which does not imply having to consent to the use of their data; or
- the publisher must be able to demonstrate, in particular to CNIL, that another publisher offers such an alternative without imposing a cookie wall.
Additionally, CNIL further specifies that such imbalance may arise in the event of exclusivity of the publisher on the content or services offered, or when the user has few or no alternatives to the service and therefore has no real choice as to the use of cookies, for example in the case of dominant or essential service providers.
'Reasonable' paywall price
In the first case, CNIL outlined that offering a paid alternative (i.e. requiring either the acceptance of cookies or remuneration for the services provided) is not prohibited in practice. However, CNIL stipulated that the price must be reasonable, i.e. not so high as to deprive users of a real choice. As opposed to setting out specific thresholds, CNIL noted that the determination of what is 'reasonable' is subject to a case-by-case analysis, further outlining that those wishing to implement a paywall must be able to justify the reasonableness of the monetary consideration offered. In addition, CNIL recommended that, for the purpose of transparency, such analysis should be published.
Limiting of cookie wall purposes
Additionally, CNIL highlighted that where cookie walls are implemented, the publisher must demonstrate that it is limited to the purposes which allow fair remuneration for the service offered. To illustrate this requirement, the guidance provides that if a publisher considers that the remuneration for its service depends on the income it could obtain from targeted advertising, only consent for this purpose should be necessary to access the service; the refusal to consent to other purposes should not prevent access to the content of the site.
Deposit of cookies where cookie wall alternative is selected
Further to the above, CNIL stipulated that, as a general rule, where the user chooses the publisher's alternative to the cookie wall, no cookies or similar trackers should be deposited by the publisher, with the exception of those strictly necessary for the provision of the requested service. However, as a further exception, CNIL noted that publishers may request, on a case-by-case basis, the user's consent to the deposit of cookies or similar trackers when the latter are required to access content hosted on a third-party site (e.g. to view a video hosted by a third-party site), provided that the required information is made available to users, including:
- the fact that activation of external content requires purpose-specific consent;
- a link to the privacy policy (in French) of the external content provider;
- the possibility of easily withdrawing consent at any time; and
- the consequences of not providing consent, i.e. not being able to access the service.
