CNIL updated FAQs on cookies guidelines: Deadline to comply ends on 1st of April

On 18 March 2021, the French data protection authority CNIL released Questions and Answers to aid organizations to comply with its amended guidelines on the use of cookies and similar tracking technologies. Organizations have time till 1st of April, after which the CNIL will be empowered to take enforcement actions against organizations failing to comply with its requirements on cookies.

Let’s look into some key points highlighted by the CNIL in its recently released Questions & Answers.

1. Simple navigation of the user or relying on the browser settings of the user does not constitute valid consent to the use of cookies or other similar tracking technologies.
2. Trackers used for audience measurement are exempt from obtaining the user’s consent, provided they are strictly necessary for the provision of the service requested by the user, are used only to produce anonymous statistical data, do not allow the tracking of the navigation of the user, and do not allow the data to be cross-checked with other processing or for the data to be transmitted to third parties.
3. Website publishers must always inform users about the use of all cookies, including cookies for which user’s consent is not required.
4. Website publishers are recommended to retain users’ choices for a period of six months, to not ask them to consent again and again, and from page to page. This recommended retention period may vary depending on the nature of the website and the specificities of its audience.
5. It is essential to obtain the user’s consent to allow third parties, via social network buttons, to place or read trackers on the user’s terminal equipment.
6. Users must be informed of the identity of data controllers (including joint data controllers), any third-parties with whom their data is intended to be shared, the purposes of the use of cookies, the possibility of withdrawing consent at any time, and the consequences of accepting and refusing the use of cookies. All of this information must be complete, visible and presented in a manner that is not misleading for users.
7. Each purpose of cookies must be highlighted in a short title on the cookie banner, accompanied by its brief description. Details of the purposes of the use of cookies may be made available to the user under a drop-down button or a hypertext link, taking the user to the second information layer where a detailed description of purposes is available.