On January 14, 2020, the French data protection authority (CNIL) launched a public consultation on its draft recommendations for the collection of consent in the context of cookies and other tracking technologies (the ‘draft Recommendations’). Under EU ePrivacy rules, such technologies generally may not be placed on – or accessed from – users’ devices without informed consent.
The draft Recommendations are designed to accompany the latest guidelines from the CNIL on cookies and tracking technologies, which were adopted on July 4, 2019. The draft Recommendations focus on practical implementation and provide:
- Compliance recommendations and concrete examples of practices which enable organizations to meet their legal obligations; and
- Examples of best practices which privacy-conscious organizations may choose to adopt to go above and beyond strict legal requirements.
The draft Recommendations include, for instance:
- Examples of wording which organizations may use to clearly and intelligibly describe the purposes of particular cookies;
- Practical guidance as to how “accept all” and “refuse all” buttons can be used in a compliant way; and
- Recommendations on cookies which are not subject to the requirement to obtain consent.
The new guidance and recommendations come at a time when organizations are facing increased scrutiny of cookie practices, particularly in the context of online marketing. The CNIL notes that it has received numerous complaints on this subject from individuals and groups (such as La Quadrature du Net and NOYB), and that it will – if necessary – use its powers of investigation.
The consultation will run until February 25, 2020, after which an updated version of the draft Recommendations will be presented to the CNIL’s members for final adoption. Those wishing to contribute to the consultation can publish their comments on the CNIL’s website.
