An updated version of the CNIL guidance on cookies has been published on the French Data Protection Authority's website. Highlights of the new guidance are as follows:
No consent needed for some categories of analytic cookies
Analytic cookies will be exempt from the new rules if the following conditions are met:
- User's right to access information is ensured;
- Opt-out mechanisms are easy to install and accessible from each user device (including smartphones), operating system or browser application. Information shall not be shared with analytic providers if opt out mechanisms are on;
- The analytic information is not linked to identifiable users. This means that that there will be no access to individual's information but rather access to aggregate information which includes all website users. In addition, publishers must not use the analytic information to track users across multiple websites (i.e. analytic information relating to a given website cannot be shared with others);
- Geolocation based on IP addresses is permitted. However, the analytic information should not include any greater detail than city names. IP addresses must be deleted or anonymised once the geolocation has been completed to prevent further use of the information which the CNIL considers ‘personal data’; and
- Analytic cookie lifetime and storage of analytic information must not exceed 6 months.
As a result, the banner at the top of the CNIL webpage, similar to that used on the website of the UK data protection commissioner: www.ico.gov.uk, has been removed.
However, the CNIL mentions that its position might change in the coming months depending on the decision taken by the Article 29 Working Party.
Template consent wording provided
By way of illustration, the revised CNIL guidance envisages two practical situations where user consent might be needed.
Secondly, social networking platforms. The CNIL recommends using the registration page to obtain user consent, specifically to add a tick box with the following consent wording: “By checking this box, I agree to receive cookies from my-network-platform.com while surfing on partner websites so as to identify myself when I want to share my favourite content with my friends.”
The CNIL’s revised guidance (in French) is made available at: http://www.cnil.fr/en-savoir-plus/fiches-pratiques/fiche/article/ce-que-le-paquet-telecom-change-pour-les-cookies/
For more information, please contact:
Ruth Boardman (Partner) firstname.lastname@example.org
Gabriel Voisin (Associate) email@example.com