The CNIL (the French data protection authority) was the first EU Supervisory Authority to address cookie compliance with data privacy law.
In 2020, the CNIL published several sets of guidelines and recommendations to give precise guidance on the requirements of the GDPR and French Data Protection Act (“Loi Informatique et Libertés”) implementing the ePrivacy Directive, in the context of the use of cookies and other tracking technologies, with a compliance deadline of April 2021.
To the extent cookies have an advertising purpose, key requirements are:
Applied to the digital advertising (adtech) sector, these obligations result in a chain of liability, from advertisers to publishers dropping third-party cookies (i.e. cookies created by domains other than the one the user is visiting). User consent has to be obtained for the purpose of depositing advertising cookies and for data processing in relation to marketing activities, including display of targeted advertising or data sharing with third parties.
The Transparency and Consent Framework (TCF) developed by IAB Europe was set up to offer an industry-led solution to consent issues in digital advertising. It provides a 'TC String' which allows a record to be kept of user preferences for targeted advertising that can be passed on to other players in the Real Time Bidding (RTB) ecosystem. However, the difficulties resulting from the strict implementation of the CNIL guidelines coupled with ongoing issues around whether or not the TCF is GDPR-compliant (discussed in more detail here), are now pushing some stakeholders to consider cookieless tracking solutions.
An alternative favoured by some publishers is using a cookie wall, which they argue means they do not require consent. The lawfulness of this approach in France has been recognised by the CNIL provided that:
It is worth noting that the CNIL is currently conducting a consultation on the mobile app ecosystem in relation to other types of trackers such as SDKs. Further CNIL guidelines are expected, particularly as the CNIL has identified the use of tracking technologies in mobile apps as one of its top enforcement priorities in 2023.
The noose therefore seems to be tightening around digital advertising stakeholders in France. Since 2021, the CNIL has carried out numerous compliance checks on publishers in relation to GDPR and ePrivacy requirements applicable to the use of cookies, and has fined several publishers for breaching such requirements, including those attached to the use of advertising cookies and trackers (e.g. €60 million for Microsoft and €8 million for Apple among the most recent decisions to date). Several players in the digital advertising ecosystem are now under direct threat.
A complaint was filed in November 2018 by Privacy International against, among others, three adtech companies (Criteo, Quantcast and Tapad) for alleged breaches of data protection principles (transparency, fairness, lawfulness, purpose limitation, data minimisation and accuracy), and lack of legal basis, including for processing sensitive data.
The investigation opened in 2020 by the CNIL against Criteo is ongoing. While the decision is expected in the coming months, Criteo stated in an August 2022 press release that, despite the various GDPR violations highlighted in the report of the CNIL’s investigator, it found “the merits of this report to be fundamentally flawed, and the proposed sanctions [including a €60 million fine] to be incommensurate with the alleged non-compliant actions”.
The CNIL is seen as particularly focused on the issue of cookies used by the digital advertising sector compared with other EU regulators, and as taking a stricter line than some. As technical and industry solutions develop, however, the digital advertising industry in France will have a wider range of solutions.
1 of 5 Insights
Chris Jeffery looks at the progress of the TCF framework and whether it is or is likely to evolve into a compliant data privacy solution for the digital advertising ecosystem.
2 of 5 Insights
Lukas Kolligs, Gözde Cengiz and Sasun Sepoyan look at the consequences of the Irish DPC's Meta decisions on the EU's digital advertising market.
3 of 5 Insights
Mary Rendle looks at the regulatory landscape for digital advertising in the UK.
4 of 5 Insights
Back to