cnil-compliant-cookies

Implementing CNIL-Compliant Cookies

Overview

The French Commission Nationale de l'Informatique et des Libertés (CNIL) has been the most aggressive European enforcer of cookie consent rules. In January 2022, CNIL issued a EUR 150 million fine to Google LLC and a EUR 60 million fine to Meta Platforms Ireland Ltd. for cookie consent violations. These enforcement actions, combined with CNIL Deliberation No. 2020-091 (September 17, 2020), establish the most detailed cookie consent standards in Europe.

CNIL Cookie Consent Requirements

1. Equal Prominence of Accept and Reject (CNIL Deliberation 2020-091, Section 2.1)

Requirement: Users must be able to refuse cookies as easily as accepting them. The "Refuse All" option must be presented with the same visual prominence as the "Accept All" option.

Specific CNIL Requirements:

• "Accept All" and "Refuse All" buttons must be on the same hierarchical level (same layer of the interface)
• Both buttons must have comparable visual treatment (size, color, font, position)
• Neither button may be visually promoted or demoted relative to the other
• A "Manage Preferences" option may be offered as a third option but must not replace "Refuse All"

CloudVault SaaS Inc. Implementation:

┌─────────────────────────────────────────────────────────────┐
│  CloudVault uses cookies to improve your experience.        │
│  [Learn more about our cookie use]                          │
│                                                             │
│  ┌──────────────────┐  ┌──────────────────┐                │
│  │  Accept All       │  │  Refuse All       │               │
│  └──────────────────┘  └──────────────────┘                │
│                                                             │
│  [Manage Preferences]                                       │
└─────────────────────────────────────────────────────────────┘

Button specifications:
- Both: 200x44px, #2563EB blue background, white text, 16px bold
- Position: side by side, same vertical level
- "Manage Preferences": text link below, #6B7280 grey, 14px regular

2. No Cookie Walls (CNIL Deliberation 2020-091, Section 2.2)

Requirement: Access to the website or service must not be conditioned on accepting cookies. Users who refuse all cookies must be able to access the same content and functionality.

Exceptions:

• The CNIL acknowledges that some functionality (e.g., personalized recommendations) may require cookies. In that case, a degraded but functional experience must be available.
• Paywall vs cookie wall: CNIL has indicated (Deliberation No. 2022-003) that offering a paid cookie-free alternative alongside a free cookie-funded option may be permissible under certain conditions (the "pay or consent" model), though this remains contested.

3. Six-Month Reconsent Interval (CNIL Deliberation 2020-091, Section 2.3)

Requirement: Consent must be renewed at appropriate intervals. CNIL recommends a maximum of 6 months between consent requests.

Implementation:

• Set a first-party cookie cv_consent_timestamp with the consent date
• After 180 days, re-display the consent banner
• If the user has previously refused, re-ask (they may have changed their mind)
• If the user has previously accepted, re-ask (they should confirm continued consent)

4. Essential Cookies Exemption (CNIL Deliberation 2020-091, Section 3)

The following categories do not require consent per CNIL guidance:

CNIL conditions for first-party analytics exemption:

• Data used only for aggregate statistical analysis
• Data not cross-referenced with other processing
• Cookies limited to single site
• IP addresses anonymized or truncated
• Cookie lifetime limited to 13 months, data retention limited to 25 months
• User informed of the use and right to object
• Must not enable individual tracking across sites

5. Comprehensive Information (CNIL Deliberation 2020-091, Section 2.4)

Before consenting, the user must be informed of:

• The identity of all organizations using cookies (controllers and third parties)
• The specific purposes of each category of cookies
• The consequences of accepting or refusing
• How to withdraw consent
• Cookie retention periods

CNIL Enforcement Reference

Implementation Checklist

Key Regulatory References

• CNIL Deliberation No. 2020-091 (September 17, 2020) — Cookie guidelines
• CNIL Deliberation No. 2022-013 — Google fine (EUR 150M)
• CNIL Deliberation No. 2022-014 — Meta fine (EUR 60M)
• CNIL Deliberation No. 2022-023 — Microsoft fine (EUR 60M)
• ePrivacy Directive Article 5(3) — Consent for device storage
• GDPR Article 7 — Conditions for consent
• EDPB Guidelines 05/2020 — Consent under Regulation 2016/679