Continued browsing and consent

The verdict falls on October 16, 2019. Conseil d'État authorizes CNIL not to sanction sites violating RGPD until mid-2020.

In 2018, more than 20 % of the complaints received by CNIL concerned the online marketing including tracers (such as cookies) as well as commercial prospecting. The provisions of the RGPD on consent exclude that In other words, "continued browsing of a site is synonymous with the actual expression of consent". 

However, since the beginning of July, the CNIL's new recommendations offer web players a twelve-month extension to comply with RGPD requirements. As a result, "The CNIL therefore considers continued browsing as an expression of consent to cookies and other tracking devices to be acceptable.

Dissatisfied with this decision, July 29, several associationsincluding La Quadrature du Net (which specializes in defending individual freedoms on the Internet), have challenged the CNIL's decision. Le Council of State rejected their request on October 16, on the grounds that "The one-year deadline was a reasonable transition period for website compliance". The CNIL nevertheless retains the possibility of imposing sanctions in the event of serious breaches.

In the first quarter of 2020, new recommendations proposing operational methods for collecting consent should be drawn up in consultation with webmarketing professionals.

Webmarketing strikes back

At the same time, on September 18, nine associations of web marketing professionals (GESTE, SRI, IAB France, Mobile Marketing Association France, UDECAM, AACC, FEVAD, UDM and SNCD) have lodged an appeal with the Conseil d'État to challenge the CNIL's interpretation of the RGPD and its compliance with French and European law. They criticize the institution for a lack of consultation and an overly Franco-French solution dealing with cookies and other trackers.

Consent exemption

Some cookies are exempt from consent because they are indispensable to certain operations:

  • Shopping cart cookies for e-commerce sites
  • Session identifiers
  • Authentication cookies
  • Certain audience analysis solutions
  • ...

This is not the case for cookies related to advertising operationssocial network cookies generated by sharing buttons (when they collect personal data), as well as certain audience measurement cookies.

Consent and pre-checked boxes

At European level, in a stop rendered on 1er October, the Court of Justice of the European Union confirms that it is necessary to harvest the active" consent before placing cookies on the user's terminal. Thus, a pre-checking the box by default is not a valid method of obtaining consent. This also applies if the cookie does not contain personal data.

The case was brought before the Court of Justice by the German Federation of Consumer Organizations, concerning Planet49's use of a default checkbox in online promotional games. This constituted consent to the placement of cookies for Internet users wishing to participate.

There's no doubt that the RGPD will be the subject of much more ink in the coming months. We'll keep you posted on the outcome of the various complaints currently underway. The stakes for webmarketing professionals are high.