Cookie walls : la CNIL publie des premiers critères d’évaluation

Cookie walls : la CNIL publie des premiers critères d’évaluation

Most of the services offered on the Internet are presented as free. However, this pecuniary gratuity is not without counterpart: the personal data of Internet users collected are very often used by web players to finance the services they offer by resorting, in particular, to targeted advertising.

Thus, the deposit of cookies and other tracers makes it possible, for example, to collect information on an Internet user such as his age, his place of residence or even his centers of interest and his consumption habits, in order to then offer him advertisements which are likely to interest him and therefore generate a purchase.

Faced with European requirements relating to the collection of the Internet user’s prior consent to the deposit of these tracers, many sites have chosen to use a cookie wall.

what is a cookie wall ?

The phrase “tracer wall”, or « cookie wall » in English, refers to the fact of conditioning access to a service on the acceptance, by the Internet user, of the deposit of certain tracers on his terminal (computer, smartphone, etc.).

Some sites have recourse, in the event of refusal of tracers by Internet users, to the implementation of an alternative choice consisting for the latter of having to provide another consideration. The publishers of these sites seek in this way to compensate for the loss of advertising revenue resulting from the absence of trackers by another method of remuneration.

In most cases, the counterpart is financial, we then speak of paywall » : the Internet user who refuses to accept cookies is obliged to provide a sum of money to access the site.

The Council of State’s decision on the cookie walls

By a decision of June 19, 2020, the Council of State ruled that the requirement of free consent could not justify a general ban on the practice of “tracer walls”, the freedom of consent of persons having to be assessed on a case-by-case basis, taking into account in particular the existence of a real and satisfactory alternative offered in the event of refusal of cookies.

The CNIL and the EDPS have repeatedly called on the European legislator to lay down more precise rules in this area in the future European ePrivacy regulation, which is currently being drafted.

Legality of cookie walls : the evaluation criteria

As recalled in the “cookies and other tracers” guidelines, making the provision of a service or access to a website conditional on the acceptance of the deposit of certain tracers is likely to affect, in certain cases, freedom of consent. While the requirement of “free” consent does not entail a general ban on the practice of cookie wallstheir legality must be assessed taking into account in particular the existence of real and satisfactory alternative(s) proposed in the event of refusal by the tracers.

Pending legislation or a position from the Court of Justice of the European Union, the CNIL deemed it necessary to publish criteria to assess the legality of such practices.

These criteria focus on the most commonly observed practices: they must be used as part of a case-by-case analysis.

To remember

All the principles of the GDPR remain applicable to the processing of data related to the use of cookie walls.

Particular attention should be paid in particular to information of people as well as the question of data transfers outside the European Union that the use of certain solutions would imply.

Does the Internet user who refuses tracers have a fair alternative to access the content?

When an Internet user refuses the use of tracers on a website (for example by clicking on a “refuse all” button), the CNIL recommends that publishers offer a real and fair alternative allowing access to the site and which does not imply having to consent to the use of their data.

Failing this, the publisher must be able to demonstrate, in particular to the CNIL, that another publisher offers such an alternative without conditioning access to its service on the user’s consent to the deposit of tracers, i.e. i.e. without cookie wall.

In the latter case, the publisher of the site imposing consent to the tracers to access it must be particularly vigilant to the existence of a possible imbalance between him and the Internet user, which would be such as to deprive the latter of a real choice. He must therefore ensure the access facility for the user to this alternative. Such an imbalance could exist, for example:

  • in the event of exclusivity of the publisher on the content or services offered: this may concern, for example, administrative services which cannot make access to a teleprocedure or an information site conditional on the acceptance of tracers subject to consent. The Internet user’s choice in such a case would, by definition, be constrained since the service in question is only available on the site provided by the administration;
  • when the Internet user has few or no alternatives to the service and therefore has no real choice as to the use of cookies, for example in the case of dominant or inescapable service providers.

Paid alternative: is the price reasonable?

The fact, for a publisher, of conditioning access to its content, either on the acceptance of trackers contributing to remunerate its service, or on the payment of a sum of money, is not prohibited in principle since this constitutes an alternative to consent to trackers. However, this monetary compensation must not be such as to deprive Internet users of a real choice: we can thus speak of a reasonable price.

The determination of the reasonable tariff depends on a case-by-case analysis

It is not up to the CNIL to set a threshold below which a rate can be considered reasonable, which is subject to a case-by-case analysis. The publisher who wishes to implement a paywall must be able to justify the reasonable nature of the monetary consideration offered. For more transparency with regard to Internet users, the CNIL encourages publishers to publish their analysis.

Virtual wallets can adapt to consumption patterns

The CNIL invites publishers to take into account, in the assessment of the reasonable amount, the modes of consumption of the service offered.

Indeed, the method of financing does not systematically have to take the form of a paid subscription to the site to access it without tracers. For example, the publisher may choose to use virtual purses to make micropayments to access a specific content or service on an ad hoc basis in a fluid manner and without it being necessary for the Internet user to register his credit card data with the publisher.

The creation of an account must pursue specific and transparent objectives for the Internet user

Some publishers require Internet users to create a user account. Publishers must ensure that such an obligation is justified in relation to the intended purpose (objective): this will be the case, for example, when it comes to allowing a user who has chosen to take out a subscription (monthly or annually), to benefit from this subscription on other terminals.

In addition, the publisher must respect certain principles, in particular:

  • Internet users of the use of their data;
  • limit the collection to the only data necessary for the objectives pursued;
  • if the publisher wishes to reuse the data collected during the creation of the account for other purposeshe must in particular ensure that he has beforehand and clearly informing the Internet user and collect, if necessary, the consent of Internet users for these new purposes.

A ” cookie wall ” or one ” pay wall » can it systematically impose acceptance of all the tracers on the website?

As a reminder, in general, the lack of possibility to accept or refuse trackers according to their objective, purpose by purpose can affect the user’s freedom of choice and therefore the validity of his consent.

If it is not prohibited to condition access to the site on consent for one or more purposes of the trackers, the publisher will have to demonstrate that his cookie wall is limited to purposes that allow fair remuneration for the service offered. For example, if a publisher considers that the remuneration for its service depends on the income it could obtain from targeted advertising, only consent for this purpose should be necessary to access the service: the refusal to consent to other purposes ( personalization of editorial content, etc.) should not then prevent access to the content of the site.

The publisher must clearly inform Internet users of the purposes for which it is necessary – or not – to consent to access the service.

To note : targeted advertising and personalization of editorial content are two different purposes that must be distinguished when determining the purposes conditioning access to the service.

The user chooses paid access without consenting to cookies: in which (limited) cases can tracers still be deposited?

In principle, no tracer requiring the consent of the Internet user should be deposited when the latter refuses the deposit of tracers and chooses the alternative proposed by the publisher. Only tracers necessary for the operation of the website may be used.

However, the publisher may request, on a case-by-case basis, the consent of the Internet user to the deposit of tracers when the latter are imposed to access content hosted on a third-party site (for example, to view a video hosted by a third-party site) which requires the use of a cookie that is not strictly necessary, or to a service requested by the user (for example, to provide access to buttons sharing on social networks).

Indeed, some publishers integrate external multimedia content (for example, videos hosted by third-party providers) or social network sharing buttons, the access or activation of which (for example, playing the video) leads to the deposit and reading of tracers, in particular advertising, by the providers of this content (for example the platform that hosts the video). On this point, see answer question no. 20 of the “cookies and other trackers” FAQ.

The user’s consent could be collected, for example, within a dedicated window displayed when the Internet user wishes to activate the content and in which he must have clear information concerning:

  • the fact that the activation of external content, or the use of sharing buttons, requires consent to the deposit of tracers by specifying the purpose(s) of the tracers used as well as a link to the privacy policy, in French, from the external content provider;
  • the possibility of easily withdrawing consent at any time;
  • the consequences of the refusal or withdrawal of consent concerning the deposit of tracers, including the impossibility of accessing external content.

In any case, the Internet user must always have the possibility of going himself to the settings of the site to consent to certain uses (for example, the personalization of editorial content).

#Cookie #walls #CNIL #publie #des #premiers #critères #dévaluation

This will close in 0 seconds