# Regulatory Standards — Implementing CNIL-Compliant Cookies

## Primary Regulations

### CNIL Deliberation No. 2020-091 (September 17, 2020)

The definitive French cookie compliance framework:
- **Section 2.1**: Equal prominence — "Refuse All" must be as easy to find and use as "Accept All"
- **Section 2.2**: Cookie walls prohibited — consent cannot be a condition of site access
- **Section 2.3**: Consent validity — maximum 6-month reconsent interval recommended
- **Section 2.4**: Information obligations — all cookie users identified, purposes described, retention stated
- **Section 3**: Essential cookies exemption — limited list of cookies not requiring consent

### ePrivacy Directive 2002/58/EC (as amended by 2009/136/EC)

- **Article 5(3)**: Consent required for non-essential storage/access on user device. Only exemptions: cookies strictly necessary for transmission or for service explicitly requested by user.

### GDPR — Regulation (EU) 2016/679

- **Article 7**: Conditions for consent apply to cookie consent
- **Article 7(1)**: Controller must demonstrate consent — audit trail required
- **Article 7(3)**: Withdrawal must be as easy as giving consent

## CNIL Enforcement Decisions

### CNIL v. Google LLC — Deliberation No. 2022-013 (January 6, 2022, EUR 150,000,000)

Findings:
1. On google.fr, a single "J'accepte" (I accept) button was presented on the first layer
2. No equivalent "Refuser" (Refuse) button on the first layer
3. Refusing required clicking "Personnaliser" then navigating complex settings
4. Accepting required 1 click; refusing required 2+ clicks with significant cognitive load
5. This constituted a violation of ePrivacy Art. 5(3) and CNIL guidelines

### CNIL v. Meta Platforms Ireland — Deliberation No. 2022-014 (January 6, 2022, EUR 60,000,000)

Findings:
1. On facebook.com, "Autoriser les cookies essentiels et optionnels" (Allow) was prominently displayed
2. "Gérer les paramètres des cookies" (Manage) required navigating to a second page
3. No "Refuser" button on the first layer
4. Asymmetric design made refusing significantly more difficult than accepting

### CNIL v. Microsoft Ireland — Deliberation No. 2022-023 (December 22, 2022, EUR 60,000,000)

Findings:
1. On bing.com, "Accepter" button prominently displayed
2. No equally prominent "Refuser" button
3. Cookies were deposited before user made a choice on certain pages

## Supervisory Authority Comparison

| Authority | Accept/Reject Requirement | Cookie Wall Position | Reconsent Interval |
|-----------|--------------------------|---------------------|-------------------|
| CNIL (France) | Equal prominence, same layer | Prohibited | 6 months max |
| DPA Belgium (APD) | Equal prominence | Prohibited | Not specified |
| Italian Garante | Equal visibility | Prohibited | Not specified |
| AEPD (Spain) | Equal prominence recommended | Prohibited | Not specified |
| ICO (UK) | Must be easy to reject | Cookie walls questionable | Not specified (annually recommended) |