Online targeted advertisement: what action plan for the CNIL?

The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.

Meanwhile, online marketing professionals and their representatives are seeking to better understand their obligations under the General Data Protection Regulation (GDPR). The recent public formal notices have been closed and have also raised many questions.

The CNIL has therefore decided to make targeted online advertising a priority topic for 2019.

The online marketing sector is subject to two regulations that impose strict conditions, in particular for what concerns consent: the GDPR and the national regulations transposing the 2002 Directive, amended in 2009, concerning the processing of personal data and the protection of privacy in electronic communications (also known as “ePrivacy Directive”).

The questions of stakeholder in the online marketing sector focus on two central topics: direct marketing and cookies (and other tracking techniques).

• On the issues related to direct marketing (or "third party opt in"): the CNIL has repeatedly communicated the applicable rules of law (during meetings with representatives of the sector, and on its website in December 2018). The CNIL has granted a temporary period of 6 months to allow companies to comply with the applicable rules, which has now expired.
• The issue of cookies and other tracking devices: the entry into force of the GDPR and the guidelines of the European Data Protection Board on consent have strengthened the requirements for consent. They explicitly exclude scrolling down, swiping or browsing through a website or application as a valid expression of consent. Because the 2013 recommendation of the CNIL on cookies and other tracking devices allows obtaining consent via scrolling down, browsing or swiping through a website or application, it is no longer in line with the applicable rules.

Without waiting for the adoption of the ePrivacy Regulation, which is currently under discussion and which will not come into force in the short term, the CNIL must update its reference frameworks in order to bring them in line with the applicable law. This update aims at protecting data subjects and providing legal certainty for stakeholders.

The action plan of the CNIL

To support stakeholders in their compliance strategy, the CNIL has drawn up an action plan for the year 2019-2020. This plan is two-folded and was presented to the stakeholders, during a meeting held on April 25^th 2019 in the CNIL.

Step 1: publication of new guidelines in July 2019

In July, the CNIL will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular for what concerns the expression of consent), and publish guidelines outlining the applicable rules of law.

These guidelines will be based on elements that have already been harmonized at the European level.

The CNIL will give stakeholders a transitional period of 12 months, so that they have the time to comply with the principles that diverge from the previous recommendation. During this transition period, scrolling down, browsing or swiping through a website or application will still be considered by the CNIL as acceptable.

Nevertheless, the CNIL will continue to investigate complaints and, if necessary inspections to ensure, among other things, that no cookie is implemented before consent is collected. Obligations that have not been modified in the Guidelines (e.g. transparency, withdrawal of consent) as well as other obligations under the GDPR (e.g. security obligations) may also be subject to inspections and, where appropriate, corrective measures, during this transitional period.

Step 2: consultation with stakeholders to develop by December 2019 - early 2020 a new recommendation relating to the operational aspects of the collection of consent

Working sessions will be held in the second half of 2019 between the CNIL services and each category of stakeholders (content editors, advertisers, service providers and intermediaries in the marketing ecosystem, civil society), through their representative organizations. The aim of this work will be to outline practical arrangements for collecting consent and to brainstorm. The CNIL will publish its recommendation, for public consultation, by the end of 2019 or, at the latest, at the beginning of 2020.

The CNIL will carry out inspections on this the final recommendation 6 months after its final adoption.