Refusing cookies should be as easy as accepting them: results of the second campaign of orders and future actions

On 19 July 2021, the CNIL chair issued orders to around forty organisations that publish high-traffic websites and have practices that contravene the legislation on cookies. They had until 6 September to bring themselves into compliance. To date, 30 organisations have become compliant, four have requested an extension due to technical or operational constraints and four have not yet responded.

The extension requests are currently under review and will only be granted if they are properly justified. The organisations that have not responded face financial penalties of up to 2% of their turnover, as do any players whose practices do not comply with the cookie rules.

New monitoring campaigns are being prepared. Like the previous ones, they will continue to target national and international private players, as well as public bodies whose websites generate significant traffic. Furthermore, special attention will be paid to the websites of political parties due to the presidential elections which will take place in 2022. Checks will continue to focus on refusing cookies being as easy as accepting them, as well as on actual compliance with this choice.

With these actions, the CNIL is continuing to implement its plan for the overall compliance of players targeting French Internet users. The repressive policy currently being pursued by the CNIL, which was initiated at the end of 2020 with significant penalties imposed on major digital players, is an extension of the support phase that led to the adoption of guidelines and a recommendation on 1^st October 2020.

Between 2020 and 2021, the CNIL adopted around 70 corrective measures (orders and sanctions) in connection with non-compliance with the legislation on cookies. In 60% of the cases, they were organisations with a parent company outside France.

These measures mainly concerned large private-sector players from a wide variety of economic sectors.