Association des agences de communication – Court Ruling (France, 2020)

L’association des agences de communication and others contested the legality of several recommendations and principles enshrined in the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ 4th of July 2019 CNIL deliberation] on Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés. Could the CNIL decide a prohibition of “cookie walls” based on the EDPB 'soft law'? The Conseil d’Etat considered that the CNIL outpaced its powers when considering cookie walls as illegal in a soft law measure (Article 2 of its 4th of July 2019 deliberation). Cookie walls are "the practice of blocking access to a website or mobile application for those who do not consent to be tracked ("cookie walls")" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). The CNIL based its position on the EDPB (European Data Protection Board), stating that cookie walls should be forbidden because the cost of consent refusal is too high and thus the consent is not freely given ([https://edpb.europa.eu/our-work-tools/our-documents/otros/statement-edpb-revision-eprivacy-regulation-and-its-impact_en 25 May 2018, on ePrivacy]): "The EDPB considers that, in such a case, users are not in a position to refuse the use of tracers without suffering negative consequences (in this case, the ban from accessing the website)" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). CNIL concluded "that consent can only be valid if the person concerned is able to validly exercise his or her choice and does not suffer major inconvenience in the event of the absence or withdrawal of consent" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). Nonetheless, the Court still considered the CNIL had overpassed its power: "By deducting such a general and absolute prohibition from the sole requirement of a free consent, laid down by the regulation of April 27, 2016, the CNIL has exceeded what it can legally do, within the framework of an instrument of soft law, enacted on the basis of 2° of I of article 8 of the law of January 6, 1978 cited in point 3. It follows that the contested deliberation is, to this extent, tainted with illegality" (CE). All the remaining points of the CNIL guidelines were validated.