From 31 March 2020, companies using cookies and other trackers must ensure that they comply with the CNIL new guidance on cookies published in September 2020 and completed by practical recommendations on how to obtain user consent.
The CNIL notably specifies that mere continuation of navigation on a website can no longer be regarded as a valid expression of consent. Users must be able to accept or refuse trackers purpose by purpose and must be provided with a list of all operators using the trackers deposited on their device. It must as easy to refuse trackers or to accept them.
Companies using trackers must update their information notices and review their processes for obtaining user consent, or demonstrate that the tracker is one for which the limited consent exemption exception applies.
The reality check
- Has an exhaustive mapping of all cookies and trackers (first party and third party) been carried out?
- Is the information provided to users complete?
- Are cookies and trackers only deposited when the user has expressly consented (silence means refusal)?
- Is there a system in place for retaining proof of consent (or refusal)?
- Are the roles and responsibilities between the various operators using the trackers clearly assigned?
- Can some trackers be exempt from consent?
Taylor Wessing can provide support
- Audit your specific situation and implement a pragmatic action plan;
- Suggest practical solutions for obtaining consent;
- Conduct risk assessments (cookie walls, consent exemptions, joint liability of the different operators…);
- And so much more…