# CNIL Cookie Banner Standards and Legal References

## CNIL Regulatory Framework

### CNIL Deliberation No. 2020-091 (17 September 2020)
- Title: "Lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture ou écriture dans le terminal d'un utilisateur"
- Establishes that consent for cookies must meet GDPR Article 4(11) standards
- Confirms that scrolling or continued browsing does not constitute consent
- Requires consent to be as easy to refuse as to accept

### CNIL Recommendation on Cookies (1 October 2020)
- Provides practical implementation guidance complementing the Deliberation
- Key requirements: equal prominence accept/reject, no cookie walls, 6-month reconsent cycle, 13-month maximum cookie lifetime
- 6-month grace period for compliance (expired April 2021)

## CNIL Enforcement Actions

### Google LLC — EUR 100,000,000 (31 December 2021)
- Decision: SAN-2021-023
- Violations: google.fr deposited cookies without prior consent; no mechanism to refuse cookies as easily as accepting them
- The "Reject All" option was hidden behind multiple clicks while "Accept All" was one click

### Google Ireland Limited — EUR 50,000,000 (31 December 2021)
- Same decision as Google LLC; joint liability for youtube.com cookie practices

### Meta Platforms Ireland Limited — EUR 60,000,000 (31 December 2022)
- Decision: SAN-2022-021
- Violations: facebook.com did not offer a mechanism to refuse cookies as easily as accepting them
- The reject mechanism required multiple navigation steps

### TikTok — EUR 5,000,000 (29 December 2022)
- No equivalent reject button; cookie settings hard to access

### Criteo — EUR 40,000,000 (15 June 2023)
- Consent not freely given; insufficient information about data processing
- Consent collection did not meet GDPR standards

### Amazon France Logistique — EUR 32,000,000 (28 December 2023)
- Cookies deposited on amazon.fr without prior consent
- Advertising cookies set before user interaction with consent banner

## ePrivacy Directive Framework

### Article 5(3) — Confidentiality of Communications
- Member states must ensure that storing/accessing information on user equipment requires informed consent
- Exemption for technically necessary storage
- Implemented in France via Article 82 of Loi Informatique et Libertés

### French Implementation — Article 82, Loi n° 78-17 (Loi Informatique et Libertés)
- French transposition of ePrivacy Article 5(3)
- CNIL is the supervisory authority for enforcement

## GDPR Requirements Applicable to Cookie Consent

### Article 4(11) — Consent Definition
- Freely given, specific, informed, unambiguous indication by statement or clear affirmative action

### Article 7 — Conditions for Consent
- Controller must demonstrate consent was given (7(1))
- Consent request must be clearly distinguishable (7(2))
- Withdrawal must be as easy as giving consent (7(3))

### CJEU Case C-673/17 (Planet49)
- Pre-ticked boxes invalid; active consent required
- Duration and third-party access must be disclosed