Cookies: the new rules and recommendations of the CNIL


The CNIL is updating its guidelines and recommendations concerning cookies and other tracers.

It should be as easy to refuse cookies as it is to accept them. © New Africa – stock.adobe.com

New rules for better control of online tracers

The CNIL has just adopted new guidelines on the use of cookies and other tracers. These new applicable rules will allow better control of advertising targeting. The main objective is also to allow Internet users to keep control of their personal data in the face of cookies and tracers used on the sites.

In these new guidelines, the following are important:

  • concerning the information of persons: the Internet user must be clearly informed of the uses of cookies or tracers on the site and of the consequences linked to its acceptance or rejection. The identity of the actors using the tracers granted by the Internet user must also be clearly indicated.
  • regarding user consent: if a user continues to browse the site without having accepted cookies, this cannot be considered as consent. Individuals must consent to the use of cookies by a specific act such as clicking on an “I accept” button. It must be as easy to refuse trackers as to accept them, and Internet users must be able to withdraw their consent at any time.

Note: it is specified that certain tracers will be exempt from the collection of consent in specific cases: tracers used for authentication with a service, tracers allowing Internet users to keep the content of their shopping cart on a site, etc.

The CNIL asks the actors concerned to ensure the compliance of their practices before the end of March 2021 in order to meet the requirements of the GDPR and the ePrivacy directive.

The list of CNIL recommendations

The CNIL makes 3 recommendations that sites should follow:

  • a compendium interface or banner should contain a button Accept all and also a button Refuse everything to leave a real choice to visitors,
  • sites which keep consent to cookies for a certain period of time should also keep the refusal of Internet users so as not to request consent again on each of their visits,
  • if trackers allow tracking on sites other than the site visited, consent should be obtained at each site concerned. This allows the user to better understand the scope of their consent.

The regulation of advertising targeting, a priority for the CNIL

Following the new data protection requirements (RGPD) which came into force in May 2018, the CNIL has implemented an action plan on advertising targeting. In July 2019, it adopted the guidelines which recalled the applicable rights.

In addition, in January 2020, it also launched a draft of recommendations which invited Internet users and web professionals to give their opinion on the processing of the consent of Internet users. The CNIL then based itself on this project to enrich the final version adopted on September 17, 2020 which lists the new guidelines unveiled today.

Receive all digital news by email