The French Court Rules that the Country’s Data Protection Authority Does Not Have the Right to Ban Cookie Walls

On June 19, 2020, the France’s highest administrative court ruled that the country’s data protection authority does not have the right to ban cookie walls.   Cookie walls are scripts that block website content from being visible except for a request to accept cookies and the information about which cookies are being set. A website visitor’s agreement to have their internet browsing being tracked for ad-targeting is a price for accessing the content of the website.

The lawsuit was a challenge by industry associations representing publishing, advertising, media, and e-commerce to the consent guidelines for cookies and other trackers released by the French data protection authority, Commission nationale de l’informatique et des libertés (the CNIL) in July 2019.  The purpose of the new guidelines was to bring CNIL’s position on tracking in line with the GDPR.

The court ruled that a blanket prohibition of cookie walls exceeds what is allowed under the GDPR and that consent is considered freely given and valid as long as consumers are given multiple options for accessing content, for example by cookie tracking, a paywall, or registering for free with an email.

Generally, under the GDPR, consent can only be an appropriate basis for processing personal data if a data subject is offered control and a genuine choice regarding accepting or declining the terms offered or declining them without detriment. In the Guidelines 05/2020 on Consent under Regulation 2016/679 (GDPR) issued in May of this year, the European Data Protection Board concluded that cookie walls are inconsistent with the GDPR.

According to the EDPB, in order for consent to be freely given, access to service and functionalities must not be made conditional on the consent of a user to the storing of information or gaining access to information already stored, in the terminal equipment of the user.   Thus, where a website provider puts into place a script that will block content from being visible except for a request to accept cookies and the information about which cookies are being set, and there is no possibility to access the content without clicking on the “accept cookies” button, the data subject is not presented with a genuine choice and the consent is not freely given under the GDPR.  The EDPB did not expressly address the possibility of alternative ways to access content, such as via a paywall.

While the French court’s ruling is a win for publishers and ad tech companies, it leaves them in somewhat of a limbo given that the ruling might be inconsistent with the EDPB’s position.  Data protection authorities in other EU countries are also in disagreement on the legality of cookie walls.   For example, the data protection authority in the Netherlands prohibits the use of cookie walls, while the Austrian authority concluded that they are permissible as long as website visitors are presented with some degree of choice.

 Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653