Introduction

Cookies are small pieces of information, usually consisting of letters and numbers, that are installed on users’ devices by the websites that use them. Cookies are used for a variety of purposes, including personalising the advertising shown to the user visiting a particular site. Some website operators condition free access to their published content on the user’s consent to the placement of certain cookies on the user’s device. This practice, known as the use of cookie walls, has been found by the European Data Protection Board (EDPB) to violate the “voluntary” consent requirement in Article 4(11) of the GDPR[1] (point 39 of the EDPB Guidelines 05/2020 on consent under Regulation 2016/679). On 16 May 2022, the French supervisory authority (Commission Nationale Informatique et Libertés, CNIL) issued a communication on the possible acceptability of cookie walls. In this article I set out the authority’s position.

At the beginning of its communication of 16 May 2022, the CNIL refers to the decision of the Council of State (Conseil d’État) of 19 July 2021, which stated that the requirement of voluntary consent cannot justify a general ban on the practice of “tracker walls”, and that the freedom of persons to consent must be assessed on a case-by-case basis, taking into account in particular the existence of a real and satisfactory alternative offered in the event of refusal of cookies.

Therefore, pending the action of the legislator or the case law of the Court of Justice of the European Union, the CNIL has decided to put forward the following criteria that may help website operators to assess whether their use of cookie walls carries the risk of infringing the principle of “voluntariness”:

  • Is there a fair alternative for a user who does not want to use trackers to access content?

The CNIL points out that a website publisher that makes access to a website conditional on consenting to the installation of cookies must offer a real and fair alternative to access the website that does not involve consenting to the use of personal data. The requirement of voluntary consent will not be respected if the website hidden behind the cookie wall contains content or services offered exclusively by its publisher.

  • Is the fee reasonable for a paid alternative?
  • Can a cookie wall or paywall systemically force acceptance of all site trackers?

The CNIL points out that a website publisher using a cookie wall must demonstrate that it is limited to purposes that allow fair remuneration for the service offered. For example, if the publisher considers that the remuneration for its service depends on the revenue it could generate from targeting-based advertising, only consent for this purpose should be necessary to access the service – refusal to consent for other purposes (content personalisation, etc.) should not prevent access to the website content.

  • In what (limited) cases can cookies still be installed when a user opts for paid access to content without consenting to cookies?

The CNIL explains that, as a general rule, trackers requiring the consent of the Internet user should not be installed when the latter chooses the alternative proposed by the publisher. Only cookies necessary for the operation of the website may be used.

Other authorities have so far not shared the CNIL’s position, which is one possible interpretation of the data protection legislation. The CNIL message on the cookie walls is available here: https://www.cnil.fr/fr/cookies-et-autres-traceurs-le-conseil-detat-rend-sa-decision-sur-les-lignes-directrices-de-la-cnil.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).