The French data protection authority, the CNIL, has undertaken a long-term campaign to ensure the effectiveness of such its cookie rules under the moto: “refusing cookies should be as easy as accepting them”.
Its investigation and enforcement program started in October 2020, first based on the old 2013 version of the cookies rules and, since April 1, 2021 on the new  guidelines and recommendation on cookies revamped to meet GDPR standards, published on October 1, 2020 and effective since end of March 2021 (after a 6 month grace period).
This program was established in the context of the CNIL’s groundbreaking fines (€100 million and €35 million) on two big tech companies, for their cookie practices, in December 2020.
The CNIL’s cookies investigation program has been implemented by way of successive campaigns. Following each of these campaigns, the CNIL has issued formal notices to the organizations suspected of having breached its cookies rules. A formal notice is an injunction from the President of the CNIL addressed to a controller or a processor to cease breaches of the data protection regulation within a set period (generally one month). It is not a sanction, but if not complied with, it can be followed by a sanction procedure.
Following the first investigation campaign in May 2020, the CNIL served formal notices on some 20 organizations, “mainly large companies in the digital economy.” Following the second campaign in June 2021, the CNIL served notices on 40 other organizations that included four major digital platforms; six  hardware and software manufacturers; six B2C ecommerce sites;  two online tourism businesses; three car rental companies; three major players in the banking sector; two local authorities; two online public services; and an energy company. Most of the organizations notified corrected their practices shortly after.
The CNIL noted that in 60 % of the cases the organizations had a parent company outside of France.
As announced in a press release on December 14, 2021, following the most recent (third)campaign, the CNIL issued formal orders on 30 organizations that included public institutions, higher education providers and companies in the clothing, transport, retail, and distance sales industries.
The press release identifies the following wrongful practices, which publishers should be sure to address to avoid scrutiny by the CNIL:
Cookies subject to consent are automatically set on the user’s terminal before acceptance by the user, upon arrival on the site, thus without consent;
Information banners are still not compliant because they do not allow refusing the setting of cookies as easily as accepting them;
Information banners seem to offer the user a means of refusing cookies as easily as accepting them, but the actual proposed mechanism is not effective, because cookies subject to consent are still set even after the refusal expressed by the user.
In that statement, the CNIL also reminds stakeholders that fines can reach of up to 2% of annual worldwide turnover. However, other than the two above-mentioned sanctions in December 2020, which dealt with large and high profile enterprises, it is difficult to assess what level of fines are likely for publishers. There is, however, at least one other case where the sanction related only to cookie practices, which is a fine of €500,000 on a newspaper in July 2021. What is, however, clear is that the CNIL is making compliance with its cookie rules an enforcement priority and publishers should evaluate their cookie practices and bring them into compliance or face the potential for material repercussions.
About this Author
Stephanie Faber heads the Data Privacy & Cybersecurity Practice and the Intellectual Property & Technology Practice in the Paris office. She specialises in international business law, with more than 20 years of experience. Her legal practice encompasses business transactions and operations, as well regulatory and compliance work.
In relation to the Data Privacy & Cybersecurity Practice, Stephanie advises on:

You are responsible for reading, understanding and agreeing to the National Law Review’s (NLR’s) and the National Law Forum LLC’s  Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on are intended for general information purposes only. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other professionals or organizations who include content on the National Law Review website. If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor.  
Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is  intended to be  a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional.  NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us. 
Under certain state laws the following statements may be required on this website and we have included them in order to be in full compliance with these rules. The choice of a lawyer or other professional is an important decision and should not be based solely upon advertisements. Attorney Advertising Notice: Prior results do not guarantee a similar outcome. Statement in compliance with Texas Rules of Professional Conduct. Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials.
The National Law Review – National Law Forum LLC 4700 Gilbert Ave. Suite 47 #230 Western Springs, IL 60558  Telephone  (708) 357-3317 or toll free (877) 357-3317.  If you would ike to contact us via email please click here.


Leave a Reply