On June 28, 2019, the French Supervisory Authority (CNIL) announced that it will issue new guidelines on the use of cookies for direct marketing purposes.  It will issue these guidelines in two phases.

First, during July 2019, the CNIL will update its guidance issued in 2013 on cookies.  According to the CNIL, the 2013 guidance is outdated because it refers to implied consent (i.e., consent through the continued use of the website) as an acceptable mode of obtaining consent to place cookies.  The new guidance will rule out the use of implied consent to place cookies on users’ devices.  However, the CNIL will not enforce the new rules for a period of twelve months.

In the second phase, the CNIL will consult with relevant stakeholders in order to create new guidelines on how to obtain consent for the use of cookies.  The CNIL intends to publish draft guidelines in December 2019 or January 2020 for public consultation.  Once the new guidelines are adopted, the CNIL will grant companies a 6-month transition period to implement the new guidelines.

According to the CNIL, it can no longer wait for the approval of the ePrivacy Regulation, which is not expected to be finalized in the short term.

 

 

 

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Kristof Van Quathem Kristof Van Quathem

Kristof Van Quathem advises clients on information technology matters and policy, with a focus on data protection, cybercrime and various EU data-related initiatives, such as the Data Act, the AI Act and EHDS.

Kristof has been specializing in this area for over twenty…

Kristof Van Quathem advises clients on information technology matters and policy, with a focus on data protection, cybercrime and various EU data-related initiatives, such as the Data Act, the AI Act and EHDS.

Kristof has been specializing in this area for over twenty years and developed particular experience in the life science and information technology sectors. He counsels clients on government affairs strategies concerning EU lawmaking and their compliance with applicable regulatory frameworks, and has represented clients in non-contentious and contentious matters before data protection authorities, national courts and the Court of the Justice of the EU.

Kristof is admitted to practice in Belgium.

Photo of Anna Sophia Oberschelp de Meneses Anna Sophia Oberschelp de Meneses

I assist companies in navigating EU laws on technology, with a focus on data protection, cybersecurity, and consumer protection. My goal is to make complex regulations, such as the GDPR, AI Act, Unfair Commercial Practices Directive, and Digital Services Act, more accessible and…

I assist companies in navigating EU laws on technology, with a focus on data protection, cybersecurity, and consumer protection. My goal is to make complex regulations, such as the GDPR, AI Act, Unfair Commercial Practices Directive, and Digital Services Act, more accessible and relevant to everyday business operations.

Regarding data protection and privacy, I guide businesses on GDPR, ePrivacy Directive, and EU marketing laws, covering topics like international data transfers and privacy-focused marketing. Regarding cybersecurity, I help with risk assessments, incident response planning, and staying informed about regulations such as NIS2 and the Cyber Resilience Act. Regarding consumer protection, I assist companies in ensuring their terms are enforceable, their online platforms clearly provide required information, and their practices comply with rules against banned commercial activities.

Fluent in several languages and experienced in international contexts, I am committed to integrating compliance smoothly into business operations, enabling companies to succeed in the dynamic digital environment.