France: CNIL to begin cookies enforcement in October

Data Protection, Privacy and Security Alert


Starting in October, France’s Data Protection Authority (the CNIL) will verify compliance with its December 2013 Recommendation on the use of cookies and tracking technologies.

The CNIL’s inspections will follow “cookies sweep day,” which is planned to take place the week of September 15, 2014, during which European Union Data Protection Authorities will review how Internet users are notified of the use of cookies, and how their consent to such use is obtained.

The CNIL recently announced that, as from October 2014, it will verify compliance with its recommendation on cookies and tracking technologies issued on December 5, 2013. Compliance checks will be conducted through on-site and online inspections.

The CNIL may review:

  • The types of cookies used by Internet websites (such as HTTP cookies, local shared objects or finger-printing techniques)
  • The purpose of the cookies: (i) whether website operators are aware of the purpose of all the cookies that are set or read from their websites (including first-party and third-party cookies), and (ii) whether cookies are set that have no purpose (e.g.: obsolete cookies).

Furthermore, in cases where the cookies’ purpose requires obtaining users’ prior consent, the CNIL will review:

  • How users’ consent is obtained
  • The visibility, quality and simplicity of the information pertaining to the use of cookies
  • The consequences of users’ refusal to consent to the use of cookies
  • The possibility for users to withdraw their consent at any time
  • Cookies' lifespan and consent period (the CNIL recommends a maximum validity of 13 months).

The other statutory provisions pertaining to the use of cookies, such as data security and sensitive data, may be subject to compliance verifications as well. Depending on the inspections’ outcome, the CNIL may issue cease and desist letters and sanctions.

For more information about compliance with France's cookie recommendation and European Union policy, please contact:

Carol A. F. Umhoefer
Jeanne Dauzier
Mathilde Hallé

For more information about our global practice, please contact:

Jim Halpert