Third-party cookies: a new text adopted and already in effect! Alongside the GDPR (which has already given you some work recently), on July 4, 2019, the CNIL published new recommendations on cookies and other trackers. Like other marketing channels, stricter obligations now apply to all website publishers for obtaining the consent of internet users.
What needs to be done?
Since 2009, cookies and other tags have been subject to legislation (coming straight from Europe) 2009 with the so-called “ePrivacy” directive, better known in France as the “Information and Freedoms Law.”
What is it? The deposit of cookies requires clear and complete information to the user about their purpose, the means to oppose them, and their prior consent. Therefore, they must be presented transparently. For everything you do for your newsletter, you must apply these rules to your cookies.
The only exception: technical cookies that are strictly necessary to deliver the service and operate the site are exempt from consent. Specifically, these are the scripts/cookies related to the shopping cart, language selection, etc. For the rest, no other deposit of cookies can be made without the user’s consent.
What is changing?
In its previous guidelines of 2013, the CNIL advocated a relatively flexible interpretation of the notion of consent. The procedure consisted of two steps:
(1) Firstly, a banner had to notify the user in case of cookie deposits, allowing them to oppose them via a link on the flag. From then on, continuing navigation implied consent to depositing cookies on their device.
(2) It was also necessary to provide a specific cookie page with more information and where the user could accept or refuse cookies if they wished, as categories of cookies by types of cookies.
It is this collection of consent via continuing navigation that is no longer recognized as valid: it is now necessary for the user to clearly say yes or no, and no tacit agreement is possible. This is what CNIL highlights in its new guidelines for all website publishers.
When should these changes be made to your site?
The CNIL stated on July 18 that this adaptation period would end six months after its recommendation – in June 2020 – concerning the practical methods for obtaining consent.
Continuing navigation as an expression of consent will remain acceptable during this period. However, as a precaution, several sites have already chosen to comply with the new obligations.
Numerous checks are already underway, particularly with e-commerce and applications. It is therefore strongly recommended to take care of it now to avoid doing it at the last minute if the CNIL were to knock on your door.
The regulator has recently audited several clients, and the checks have passed with flying colors.
