The CNIL does not only want the information banners on cookies to be complete and to seek the consent of Internet users. The authority also wants the refusal to be as simple as the approval. Two campaigns have already made it possible to adjust the banners of high-traffic sites.
By dint of seeing them, Internet users in France must now be very familiar with the banners that appear at the bottom of the screen when visiting a new website. These inserts invariably ask them if they agree or not with the use of cookies and at the same time specify what their purposes are. Some of these cookies are indeed optional and can be linked to advertising.
These banners, although they can be annoying in the long run, must meet certain requirements: all the purposes pursued with these cookies must be informed. Some of them are subject to consent, but others are not, as they are essential for the proper functioning of the site. We must also be able to refuse them. Finally, the refusal should be as accessible and simple as the approval.
Refusing should be as easy as accepting
It is on this last point that a certain reluctance is noted, but the National Commission for Informatics and Freedoms (Cnil) is watching. In mid-May, she had decided to give notice to nearly twenty platforms that offered banners that did not quite put the “Accept” and “Refuse” buttons on the same footing. All of them ended up falling into line at the end of June.
In July, the authority in charge of the protection of personal data launched a second salvo, larger this time, since nearly forty organizations were targeted. This time, it is not a full box, but almost: according to a progress report published on September 14, thirty of these organizations have brought themselves into compliance and four others will do so, but have requested a delay.
Only four organizations, not named, have not yet responded to the Cnil’s requests. The independent administrative authority recalls that these four, as well as all the others, had until September 6 to comply with the regulations. It also underlines the pecuniary risk of ignoring these rules: the CNIL can impose penalties the amount of which can reach 2% of the turnover of the offender.
Beyond the four organizations, the CNIL does not give the identity of the controlled platforms. We know that these are the most prominent sites on the web: public bodies and private actors, whether French or foreign. What they have in common: they operate sites that generate significant traffic. Indeed, a possible infringement would have larger proportions. Note that Google is subject to control.
By adding the results of the first campaign with those of the second, the Cnil was able to obtain the correction of the information banners in more than 85% of cases. A figure that could increase further if the four organizations that requested additional time will also make the appropriate adjustments. The CNIL reminds that deadlines are only granted if they are well justified.
Future campaigns will take place in the weeks and months to come. It should be noted that with the upcoming election year, public organizations and private groups in France and internationally will not be the only ones to be targeted. With the presidential election of 2022, followed by the legislative elections, the CNIL intends to take a very close look at the sites of political parties.
