France’s CNIL issues Guidance on the Use of “Cookie Walls” – By Paul Lanois

On 16 May 2022, the French data protection authority, the CNIL, published a new guidance in relation to the use of “cookie walls”, i.e. the practice of conditioning access to a service on the acceptance, by the website user / visitor, of the deployment of cookies or trackers on the user’s device (e.g. computer, smartphone, etc.).

In order to provide a free service, some websites compensate for the loss of advertising revenue resulting from the absence of cookies (or other similar tracking technologies) by another method of compensation, for example by asking users to pay a subscription fee (also referred to as “pay wall”) to access all content on the website.

According to the new guidance from the CNIL, the GDPR’s requirements on consent (e.g. consent must be specific and freely given) does not mean that ‘cookie walls’ are generally prohibited.

By way of reminder, the CNIL did not always have this view: in 2019, the CNIL initially prohibited cookie walls on the basis that they violate the principle of “free consent.” The French Council of State ruled on 19 June 2020 that the CNIL did not have the legal power to outright prohibit website publishers from blocking access to content when a user does not consent to cookie tracking. Instead, the French Council of State held that a case-by-case analysis is required to determine the validity of the use of cookie walls. The CNIL subsequently revised its cookie guidance to indicate that cookie walls may be valid, without specifying what criteria to use to determine the validity of the cookie walls. The latest guidance from the CNIL aims to remedy this.

Does the user refusing the cookies have a fair alternative to access the content?

The CNIL provides in its new guidance that cookie walls may be valid, depending on, in particular, the existence of “a real and satisfactory alternative” proposed in the event of refusal of such cookies or trackers. Otherwise, the website publisher would have to be able to demonstrate, in particular to the CNIL, that another website publisher offers such an alternative without conditioning access to its service on the user’s consent to the deposit of cookies or trackers, i.e. without a cookie wall.

When an Internet user refuses the use of cookies or trackers on a website (for example by clicking on a “Refuse All” button), the CNIL indicates that the publisher of a website has to ensure that it does not create an imbalance to the detriment of the internet user. Instead, the publisher of a website must ensure the user’s ease of access to an alternative. Such an imbalance could exist, for example:

• In case of exclusivity of the publisher on the content or services offered: for example, this would be the case for online public services that provide certain information or allow certain formalities performed online. The choice of the Internet user would in such case be limited since the service is only available on the site provided by the public service;
• When the user has few or no alternatives to the service and therefore has no real choice as to the use of cookies, for example in the case of dominant or unavoidable service providers.

2) Access fee alternative: is the price reasonable?

According to the CNIL, conditioning access to content, either on the acceptance of cookies to contribute the remuneration of the service, or on the payment of a fee, may be possible since that would constitute an alternative to consent to the use of cookies. However, such monetary consideration must not amount to depriving Internet users of a real choice: the price must therefore be ‘reasonable’, assessed on a case-by-case basis.

The website publisher who wishes to implement a paywall would have to justify the reasonableness of the proposed payment and demonstrate that the cookie wall is limited to the purposes that allow a fair remuneration of the service offered. For example, if a publisher considers that the remuneration of its service depends on the revenue it could obtain from targeted advertising, only consent to this purpose should be necessary to access the service: the refusal to consent to other purposes (personalization of editorial content, etc.) should not prevent access to the content of the site.

For greater transparency towards Internet users, the CNIL encourages website publishers to publish their analysis. The CNIL also indicated that such a fee does not necessarily have to take the form of a subscription to the site: the website publisher can opt for a virtual wallet instead, allowing users to make micropayments to access a particular content or service on an ad hoc basis.

Nevertheless, the requirement for users to register themselves and create an account must be justified in relation to the intended purpose and comply with certain principles, such as:

• informing Internet users of the use of their data;
• limiting the collection to only the data necessary for the purposes pursued;
• in case there is an intention to reuse the data collected during the account creation for other purposes, the user must be clearly informed of this and the consent of the users for these new purposes may need to be sought.

In any case, all the principles laid out in the GDPR remain applicable, including limiting the collection to only the data necessary for the purposes pursued; and clearly inform the user if the website publisher wishes to reuse the data collected during the creation of the account for other purposes.

The CNIL recognizes the legality of offering access for a fee as an alternative to acceptance of cookies. However, the fee must not be such as to deprive Internet users of a real choice.