Cookie regulation: the CNIL is continuing the action plan initiated in 2019 and has imposed two fines on SHEIN and GOOGLE

In 2019, the CNIL initiated an action plan by publishing guidelines and a recommendation on the use of cookies, with the aim of promoting compliance by professionals on this matter, while ensuring that internet users are properly informed. Since 2020, several sanctions have been imposed on organizations that failed to comply with the law on advertising cookies (Article 82 of the French Data Protection Act).

The two fines imposed on GOOGLE and SHEIN by the restricted committee - the CNIL body responsible for imposing penalties - are part of the overall compliance strategy initiated by the CNIL more than five years ago with regard to cookies, which has targeted in particular operators of high-traffic websites and services.

While compliance with obligations regarding the use of cookies is improving, the CNIL remains vigilant, particularly with regard to non-compliant practices such as the placement of cookies without the internet user's consent, but also with regard to growing practices such as the use of "cookie walls", which consist of making the acceptance of the placement of cookies on the users’ device a condition to access to a service.

The restricted committee recalled in its decision against GOOGLE that, while this practice is not illegal in itself provided the consent is freely given. The various alternatives offered to the user must therefore be presented in a balanced manner, without encouraging them to choose one option over another (for example, by making one choice more complex than the other). Consent must also be informed, i.e. individuals must have a complete and clear understanding of the consequences of their choices.

Furthermore, as it did in a recent decision adopted against the company ORANGE, the restricted committee also found a breach of Article L. 34-5 of the French Postal and Electronic Communications Code (CPCE) by GOOGLE for displaying advertisements in the form of emails within the Gmail messaging service, in the "Promotions" and "Social" tabs, without the prior consent of users.