Although the Guidelines are not binding, they provide the CNIL’s interpretation of the cookie rules, and non-compliance with the Guidelines may give rise to sanctions. The CNIL announced that it will carry out inspections to enforce the Guidelines after a period of six months following the adoption of the Recommendations.
Against that background, several professional associations and trade unions brought an action before the Conseil d’Etat to seek annulment of the Guidelines.
Conseil d’Etat’s Decision
In its decision, the Conseil d’Etat did not take a position on whether ‘cookie walls’ are lawful, but considered that the CNIL could not set out a general and absolute ban on ‘cookie walls’ in a soft law instrument like the Guidelines. The Conseil d’Etat therefore annulled this provision of the Guidelines.
The Conseil d’Etat rejected all other arguments of the applicants and upheld most of the CNIL’s interpretations and recommendations included in the Guidelines, including the following:
- Users must be able to refuse consent or withdraw consent as easily as it was given.
- Users must give consent for each purpose of processing the data collected through cookies, which implies that users must receive specific information on each of the purposes of the cookies before giving consent.
- Users must be informed of the identity of the data controllers that set cookies on their devices. A list that includes these identities must be made available to users when seeking their consent and must be updated regularly.
In its Statement, the CNIL announced that it will publish a revised version of the Guidelines and the final version of the Recommendations after September 2020.