France Begins Enforcing Cookie Law

The CNIL, France’s data protection authority has written to 20 website owners about failures to comply with the French cookie law, according to a press release (French) published on June 30^th.  It is the first action taken by the regulator following initial investigations at the end of 2014.

The notices come as a result of carry out 24 spot checks, 27 online audits and 2 hearings.  Even if we assume each of these actions represents different websites – which is not clear – the written notices therefore represent a nearly 40% failure rate.

These notices from the CNIL represent the first stage in its enforcement, and would include a deadline by which the sites would need to correct their failures.

Although they have not published more details about the specific failures, it is clear from the release what they are likely to have been.  The report highlights in particular that sites are not stopping cookies prior to obtaining consent, and are also not providing sufficient opt-out mechanisms for visitors to refuse or block the use of cookies.

In particular they note that many websites tell visitors to block cookies using browser controls, which are not considered to be sufficient for compliance.  Website owners are instead required to provide tools for users to refuse the use of cookies covered by the law.

Any website owners needing to comply with the French law can use Optanon to both prevent cookies from being set before a notice or opportunity to refuse cookies has been given.  It allows users to choose which types of cookies they would like to refuse on the site, without relying on browser settings.  This approach is both in line with the CNIL’s guidance, and provides for a better user experience, which ultimately is likely to engage visitors more than cruder, non-compliant approaches.