Cookie Walls: CNIL publishes first evaluation criteria

Most of the services offered on the Internet are presented as free. However, this monetary reward is not without analogues: the collected personal data of Internet users is very often used by web players to finance the services they offer, in particular, by resorting to targeted advertising.

In this way, the storage of cookies and other tracking means makes it possible, for example, to collect information about the Internet user, such as his age, place of residence or even his centers of interest and his consumption habits, in order to then offer him advertising. which are likely to interest him and therefore trigger a purchase.

Faced with European requirements to collect the prior consent of an Internet user to host these tracers, many sites have opted to use cookie wall.

what cookie wall ?

The phrase “tracing wall” or « cookie wall ‘ in English refers to the fact of providing access to the service when an Internet user accepts a deposit of certain tracers on his terminal (computer, smartphone, etc.).

Some sites have resorted to, in the event that Internet users refuse tracers, to establish an alternative choice, which consists in the fact that the latter must provide another reward. The publishers of these sites seek in this way to compensate for the lost advertising revenue due to the lack of trackers in another way to reward.

In most cases, the counterparty is financial, then we are talking about paywall » : An Internet user who refuses to accept cookies is required to provide a sum of money to access the site.

The decision of the State Council on cookie wall

The State Council, by its decision of June 19, 2020, decided that the requirement of free consent cannot serve as a basis for a general ban on the practice of “tracing walls”, the freedom of consent of persons subject to evaluation in a case – on an individual basis, taking into account, in particular, the existence of a real and satisfactory alternative offered in the event of opting out of cookies.

The CNIL and EDPS have repeatedly asked European legislators to establish more precise rules in this area in a future European e-privacy regulation that is currently being developed.

legality cookie wall : criteria for evaluation

As stated in the “cookies and other trackers” guidelines, providing a service or accessing a website contingent on accepting a deposit of certain trackers is likely to affect freedom of consent in certain cases. Although the requirement of “free” consent does not entail a general prohibition on the practice cookie walltheir legitimacy should be assessed taking into account, in particular, the existence of a viable and satisfactory alternative offered in the event of a failure by the routers.

Pending legislation or the position of the Court of Justice of the European Union, the CNIL has deemed it necessary to publish criteria for assessing the legality of such practices.

These criteria focus on the most commonly observed practices: they should be used as part of a case-by-case analysis.

Remember

All principles of the GDPR remain applicable to the processing of data related to the use cookie wall.

Particular attention should be paid, in particular, to information about people as well as the issue of transferring data outside the European Union, which involves the use of certain solutions.

Does an Internet user who opts out of tracers have a fair alternative to accessing content?

When an Internet user opts out of using tracers on a website (for example, by clicking the Opt Out All button), CNIL encourages publishers to offer real and fair alternative allowing access to the site and not requiring consent to the use of their data.

Otherwise, the publisher must be able to demonstrate, in particular to the CNIL, that another publisher offers such an alternative without making access to its services conditional on the user’s consent to deposit tracers, i.e. without cookie wall.

In the latter case, the publisher of a site that imposes consent on tracers to access it must be especially vigilant about the existence of a possible imbalance between it and the Internet user, which would such as to deprive the latter of a real choice. Therefore, he must provide means of access for the user to this alternative. Such an imbalance may exist, for example:

  • in case of publisher exclusivity with respect to the content or services offered: this may apply, for example, to administrative services that cannot condition access to a teleprocedure or information site to the acceptance of tracers with consent. The choice of the Internet user in this case will be limited by definition, since the service in question is available only on the site provided by the administration;
  • when an Internet user has few or no alternatives to a service and therefore has no real choice regarding the use of cookies, for example in the case of dominant or unavoidable service providers.

Paid Alternative: Is the Price Reasonable?

The fact that a publisher conditions access to its content either by accepting trackers that contribute to the reward for its services or by paying a sum of money is not prohibited in principle, as it represents an alternative to opting in to trackers. . However, this monetary compensation should not deprive Internet users of a real choice: then we can talk about a reasonable price.

Determination of a reasonable tariff depends on individual analysis

The CNIL is not in a position to set a threshold below which a rate may be considered reasonable, and this is subject to analysis on a case-by-case basis. Publisher who wants to implement paywall must be able to justify the reasonable nature of the monetary reward offered. To be more transparent to Internet users, CNIL encourages publishers to publish their analysis.

Virtual wallets can adapt to consumption patterns

CNIL invites publishers to take into account the manner in which the services offered are consumed when assessing a reasonable amount.

Indeed, the funding method need not systematically take the form of a paid subscription to a site to access it without tracers. For example, publisher can use virtual wallets to make micropayments to access certain content or service on an ad hoc basis in a flexible manner and without the need for the Internet user to register their credit card details with the publisher.

The creation of an account must have specific and transparent purposes for the Internet user.

Some publishers require Internet users to create a user account. Publishers must ensure that such a commitment is justified in relation to the intended purpose (task): this will be the case, for example, when it comes to allowing a user who decides to subscribe (monthly or yearly) to use this subscription on other terminals.

In addition, the publisher must comply with certain principles, in particular:

  • Internet users about the use of their data;
  • limit fee to the only data necessary for the purposes pursued;
  • if the publisher wishes to reuse the data collected during the creation of the account for other purposeshe must, in particular, make sure that he informing the Internet user in advance and clearly and collect, where necessary, the consent of Internet users for these new purposes.

BUT” cookie wall “or one” toll wall » can it systematically enforce acceptance of all tracers on a website?

We remind you that, in general, the inability to accept or reject trackers depending on their purpose, purpose by purpose, may affect the user’s freedom of choice and, therefore, the validity of his consent.

Unless it is prohibited to condition access to the site to consent to one or more of the purposes of the trackers, The publisher will have to demonstrate that his cookie wall limited to purposes that allow fair remuneration for the service offered. For example, if a publisher believes that the remuneration for its services depends on the income that it could receive from targeted advertising, access to the service should require consent for this purpose only: opting out of consent for other purposes (personalization of editorial content, etc.). d) must not interfere with access to the content of the site.

The publisher must clearly inform Internet users of the purposes for which it is necessary – or not – consent to access the service.

Mark : targeted advertising and personalization of editorial content are two different goals that need to be distinguished when determining the goals that condition access to the service.

User chooses paywall by not agreeing to cookies: in what (limited) cases can tracers still be deposited?

In principle, a tracer that requires the consent of an Internet user should not be deposited if the latter refuses to deposit tracers and opts for an alternative proposed by the publisher. You may only use tracers necessary for the operation of the website.

However, the publisher may request on a case-by-case basis the consent of the Internet user to deposit tracers when the latter are imposed to access content hosted on a third party site (for example, to view a video hosted on a third party site) that requires the use of a cookie that is not strictly necessary or a service requested by the user (for example, to provide access to social media sharing buttons).

Indeed, some publishers integrate external media content (for example, videos hosted by third-party providers) or social media share buttons, access or activation of which (for example, playing a video) results in the deposit and reading of tracers, into specific advertisements of the providers of this content (for example, the platform on which the video is hosted). See the answer to question #20 of the Cookies and Other Trackers FAQ on this subject.

The consent of the user can be collected, for example, in a special window displayed when the Internet user wishes to activate the content, and in which he must have clear information regarding:

  • the fact that the activation of external content or the use of share buttons requires consent to the placement of tracers, indicating the purpose(s) of the tracers used, as well as a link to the privacy policy in French from the external service provider;
  • the ability to easily revoke consent at any time;
  • the consequences of refusal or withdrawal of consent to the placement of tracers, including the inability to access external content.

In any case, the Internet user should always be able to go to the site settings in order to consent to certain uses (for example, personalization of editorial content).