Association des agences de communication – Court Ruling (France, 2020)
France's highest administrative court ruled that the CNIL overstepped its authority by trying to ban cookie walls using soft law. Cookie walls block website access unless users agree to tracking, which the CNIL argued was unfair. This decision means businesses can still use cookie walls, but it highlights ongoing debates about user consent and privacy.
What happened
The Conseil d’Etat ruled that the CNIL could not ban cookie walls through soft law measures.
Who was affected
Website visitors who might be blocked from accessing sites if they refuse to consent to cookies.
What the authority found
The court decided that the CNIL exceeded its powers by trying to prohibit cookie walls without a solid legal basis.
Why this matters
This ruling shows that privacy authorities must stay within their legal limits when making rules. Website operators should watch for future changes in cookie consent laws, as this area remains contentious.
GDPR Articles Cited
National Law Articles
L’association des agences de communication and others contested the legality of several recommendations and principles enshrined in the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ 4th of July 2019 CNIL deliberation] on Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés. Could the CNIL decide a prohibition of “cookie walls” based on the EDPB 'soft law'? The Conseil d’Etat considered that the CNIL outpaced its powers when considering cookie walls as illegal in a soft law measure (Article 2 of its 4th of July 2019 deliberation). Cookie walls are "the practice of blocking access to a website or mobile application for those who do not consent to be tracked ("cookie walls")" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). The CNIL based its position on the EDPB (European Data Protection Board), stating that cookie walls should be forbidden because the cost of consent refusal is too high and thus the consent is not freely given ([https://edpb.europa.eu/our-work-tools/our-documents/otros/statement-edpb-revision-eprivacy-regulation-and-its-impact_en 25 May 2018, on ePrivacy]): "The EDPB considers that, in such a case, users are not in a position to refuse the use of tracers without suffering negative consequences (in this case, the ban from accessing the website)" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). CNIL concluded "that consent can only be valid if the person concerned is able to validly exercise his or her choice and does not suffer major inconvenience in the event of the absence or withdrawal of consent" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). Nonetheless, the Court still considered the CNIL had overpassed its power: "By deducting such a general and absolute prohibition from the sole requirement of a free consent, laid down by the regula
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Association des agences de communication in FR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Association des agences de communication - France (2020). Retrieved from cookiefines.eu
Last updated: