The prohibition of cookie walls set out in the French regulator (CNIL) guidelines censored by the French Council of State
These guidelines were challenged before the Conseil d'Etat by several associations and trade unions, operating in particular in the field of e-commerce and online advertising. Their main arguments asserted that:
- The procedure for adopting the guidelines was irregular;
- The guidelines are vitiated by incompetence because the CNIL (i) does not have the power to issue guidelines relating to the processing of non-personal data and (ii) relied on guidelines published by the European Data Protection Board (EDPB), which are not legally binding ;
- The CNIL unduly infringed freedom of enterprise and freedom of information by prohibiting cookie walls, and interpreted the conditions of independence and specificity of consent ;
- The CNIL has disregarded several regulatory and legislative provisions.
The Conseil d'Etat rejected the claim, with one exception. The court held that the CNIL did not exceed its powers and was entitled to adopt the guidelines, acted within the scope of its statutory powers in doing so and therefore validated all of the provisions, with the exception, however, of the one concerning the prohibition relating to the use of cookie walls.
The CNIL’s guidelines regarding cookie walls are consistent with the EDPB guidance, which indicates that the use of cookie walls is incompatible with the General Data Protection Regulation (GDPR).
In its decision, the Conseil d'Etat noted that the GDPR only requires that data subject consent be ‘freely given’. Therefore, the CNIL over-interpreted the concept of ‘freely given’ consent by indicating in its guidelines that the use of cookie walls would violate the GDPR.
Importantly, however, the Conseil d'Etat did not declare that the use of cookie walls is legal; it only indicated that the CNIL could not impose this prohibition in a soft law instrument (i.e. via its guidelines).
On its website, the CNIL indicated that it took note of the Conseil d'Etat's decision and that it would comply. An adjustment of the guidelines (strictly necessary to comply with the decision) as well as recommendations presenting their concrete modalities of application should be published in the autumn of 2020.
The position on cookie walls is not yet uniform across Europe - for example, the Dutch regulator has banned their use- and may well have to evolve as the issue of their prohibition is being considered in the context of discussions relating to the proposed ePrivacy Regulation.