By Mathieu Rosemain
PARIS (Reuters) – France’s data privacy watchdog CNIL recommended on Thursday that websites operating in the country should keep a register of internet users’ refusal to accept online trackers known as cookies for at least six months.
In specifying a registration timeframe, the guideline goes beyond European Union-wide data privacy rules adopted two years ago, adding an extra hurdle that a data protection lawyer said would put some of the companies exploiting such tools to target advertising out of business.
Under the CNIL guideline, which the watchdog said must be adopted by March, internet users have the right to withdraw their consent on cookies – small pieces of data stored while navigating on the Web – at any time and they can refuse trackers when they go on a website.
“The internet user’s silence actually implies a refusal (to accept cookies),” said Etienne Drouard of American-British law firm Hogan Lovells.
“But the CNIL imposes the collection of a refusal and (recommends) that this refusal lasts six months,” he said, predicting that stipulation would mark a “death sentence” for some publishers, media, video-on-demand platforms and advertisers.
The guidelines apply to all companies offering services in France or based in the country, said the CNIL, which has a reputation as a staunch defender of data privacy rights.
It also said internet users should be able to easily reconsider any initial agreement concerning cookies via a web link or an icon that should be visible on all the website pages.
The authority added that the users must be “clearly informed” of the end-use of the trackers before asking for consent. Websites must also tell internet users which entities would be collecting the data.
The legality of the use of so-called “cookie walls”, which prevent internet users from entering the website without agreeing on cookies first, has to be assessed on a case-by-case basis, the CNIL said.
(Reporting by Mathieu Rosemain; editing by John Stonestreet)
