In 2019, the legality of cookie walls was questioned by France’s data protection authority, the Commission nationale de l'informatique et des libertés, in its guidelines on cookies and other trackers. The CNIL took the plea of a general ban on cookie walls as it considered consent provided by users was not free. The CNIL’s view was that users had no choice but to consent to the tracking to access the website.
However, on 19 June 2020, France’s administrative supreme court, the Conseil d’Etat, overturned this ban. Without ruling on the merits, the Conseil d’Etat considered the CNIL abusively used its soft law power since it could not use its guidelines to create a general and absolute new obligation against website editors. Only the legislator could.
The CNIL amended its guidelines in 2020 accordingly, deleting any reference to a cookie walls ban and deferring to a “case by case” assessment. This is where the CNIL’s recent publication comes into play.
The CNIL’s new criteria to assess the cookie walls show it has learned from the Conseil d’Etat decision, though a bit reluctantly.
First, website publishers relying on a cookie wall must offer the user with a “real and fair” alternative. This means the publisher must provide a certain access to its website to users who did not consent to the tracking. In the event such an alternative is not offered, the publisher must be able to demonstrate that another publisher offers the same content without cookie walls and in an easily accessible way. These conditions can be fairly demanding in certain circumstances where there are not that many other comparable publishers. It is worth highlighting at this stage that this reference to a “real and fair alternative” was not explicitly present in the Conseil d’Etat decision.
Second, the CNIL focuses on paywalls. Such paywalls offer the users to pay a said sum of money rather than be tracked by cookies. However, publishers must determine a “reasonable fee” and be able to demonstrate it is proportionate to the purposes. Besides, the CNIL encourages publishers to publicize their analysis.
Website publishers should be relieved: They may continue using cookie and paywalls. However, there is a lot of uncertainty and room for interpretation here.
Indeed, how can one comply with such vague criteria? To what "real and fair alternative" does the CNIL refer to? How can publishers ensure another publisher offers the same content as the one on their website? Such verifications require time and money and will be easily challenged by a regulator. Concerning paywalls, the CNIL refrains from setting a threshold for where the price of paywalls is no longer reasonable.
The cookie saga is far from over.