- It is essential to inform the internet user of the cookies that can be placed on his terminal by allowing him to identify those that are mandatory or subject to his consent, as well as the consequences of his possible opposition to the placing of these cookies.
- The sole proposal to the user to set up his browser is not a valid mode of opposition.
Context
Further to a control, the publisher of the website challenges.fr, the company Editions Croque Futur, had been noticed formally by the CNIL to comply with the French Data Protection Act within 3 months.
Among the breaches noted, the latter was particularly accused of breaching his obligation to provide information and his obligation to provide to the user a means of opposition to the placing of cookies on his terminal.
No suitable response had been sent by the publisher. On May 18, 2017, the CNIL therefore imposed a financial penalty of € 25,000 against the latter.
Croque Futur Editions challenged the CNIL decision.
Court Decision
The Council of State, in its decision of June 6, 2018 (Council of State, June 6, 2018, Decision n°412589), validates the CNIL position.
Indeed, according to the law of January 6, 1978 and the directive of July 12, 2002, website publishers using cookies, have to, prior to the placing of cookies:
- inform Internet users of the purpose of the cookies, the means they have to object them and the consequences of the objection on the navigation on the website,
- collect the consent of the Internet users, unless these cookies are essential to the technical functioning of the website or unless they correspond to the provision of an online communication service at the express request of the users,
- provide Internet users with a way to disable each category of cookies individually.
In this particular case, the website challenges.fr used several types of cookies, including advertising cookies.
According to the publisher, these cookies were “necessary for the economic viability of the website” and did not require the prior consent of the Internet users.
This being so, the CNIL and the Council of State have not accepted this argument: the fact that the publisher would generate less incomes without these advertising cookies does not make them essential to the website navigation. As a result, the internaut should have been able to object the placing of this type of cookies.
However, the only means of objection offered by the website challenges.fr was the browser settings by the internet user, which is not considered as valid mode of objection.
Finally, the information provided to the website users did not allow them to clearly differentiate the categories of cookies that may be placed on their terminal, nor to be aware of the consequences, in terms of navigation on the website, attached to their possible objection.
Comment
By this decision, the Council of State recalls that the use of cookies must comply with the general rules on the protection of personal data.
This case was judged under the law of January 6, 1978 applicable at the time of the alleged acts, in 2016.
Since then, the GDPR (General Data Protection Regulation) and the adaptation of the French Data Protection Act have come into force, which reaffirm the requirement of express and specific consent for each purpose pursued regarding data processing.
As a result, many frequently encountered practices must be proscribed.
This particularly the case of the one that consists to only offers to the Internet users to set up their browser to disable cookies.
Indeed, this practice does not allow to disable each non-essential cookie individually.
In addition, if the user has to modify the settings of his browser to disable cookies, it means to the contrary that his consent was not requested prior to their activation.
Publishers also have to ensure that they no longer use a cookies banner with the wording “by using this website, you agree to the use of cookies”.
In concrete terms, it will be necessary to plan, on each website using cookies, to update the information banner and to create a real settings page allowing the user to give his specific consent and to object each cookie individually, with sufficient informative notices.
Clotilde Chatelet and Carole Isoard
IP lawyers
Inlex IP Expertise, Marseille