France allows the use of cookie walls - new decision from the French Council of State

The French Council of State (Le Conseil d’État) has in a new ruling overruled the guidelines on cookies made by the French supervisory authority CNIL in which cookie walls were not previously allowed. The ruling now renders the use of cookie walls legal in France. The ruling is expected to resonate across the EU following the European Data Protection Board issuing prior guidance on cookie walls not being allowed as a rule. The Danish supervisor authority has not yet made any comment on its stance.

Speed read

The French Council of State (Le Conseil d’État) has on June 19^th 2020 overruled the guidelines on cookies made by the CNIL  in which cookie walls were not allowed.

Without ruling on the substance of the question, the Council of State considers that the CNIL could not, under cover of an act of flexible law, enact such a general and absolute prohibition.

The ruling is expected to resonate across the EU with several member countries already having banned the use of cookie walls prior to the European Data Protection Board issuing guidance in May 2020 on cookie walls not being allowed as a rule.

The Danish supervisory authority has not yet made any comment on its stance in regards to cookie walls, but the ruling clearly depicts a divided EU on the rules of using cookies and emphasises the need for an update of the ePrivacy directive.

Key items

The key items of the decision from the French Council of State are:

• A supervisory authority could not, under cover of an act of flexible law, enact such a general and absolute prohibition: the CNIL exceeded what it could legally do in the context of an act known as “flexible law”. Soft law acts refer to instruments, such as guidelines from regulatory authorities, which do not create any legal rights or obligations for anyone, but strongly influence, in practice, the practices of economic operators.
• Cookie walls are allowed as a rule: Provided the requirements for giving consent is fulfilled cookie walls are now allowed in France.
• The ruling will have impact in the EU: The European Data Protection Board would need to rectify their guidance on consent from May 2020 as to the part of cookie walls if unity on this point is to be upheld. The Danish supervisory authority has not yet issued any stance on the ruling.
• Granularity and informed consent: Using consent with a cookie wall still requires the consent to be freely given, specific, informed and an unambiguous indication of the data subject’s wishes.
• It must be as easy to say no as it is to say yes. Providing transparency continues to be key in making the consent informed and presenting the data subject with the free choice of saying yes or no to a cookie wall with same effect, explaining why consent is needed and what a consent entails, including the possibility to withdraw the consent.

Next steps

The ruling makes it clear that cookie walls can be used in France and that clarity for other EU member countries are required either from legislators or via the courts.

The decision can be found here.