Court case N° 434684 – Court Ruling (France, 2020)

Several private companies challenges the guidelines of the CNIL on cookies on several grounds, including excess of powers. The Council of State validated most of the interpretations or recommendations provided in the guidelines: - Individuals should be able to decline to give consent as easily as to give consent; Individuals must be able to withdraw their consent as easily as they gave it; - User consent should be given for each purpose, which implies specific information; - Individuals must be informed of the identity of the controllers depositing cookies; the list containing the identity of the controllers must be made available to them at the time consent is obtained and must be regularly updated; - Data controllers must be able to demonstrate that they have obtained valid consent to the CNIL. However, in its decision of 19 June 2020, the Council of State suppressed a paragraph in which the CNIL considered that the Internet user should not suffer major inconvenience in the event of the absence or withdrawal of consent. The CNIL considered in particular that access to a website could never be subject to the acceptance of cookies ("cookie walls"). The Council of State considered that by deducting this general prohibition from the GDPR, the CNIL had gone beyond what is legally possible with guidelines, which are an instrument of "soft law".