A Presumption of Consent – The Cookie Conundrum | International Business, Trade and Taxation

In December 2013 the French Commission on Information Technology and Liberties (the “CNIL”) revised its guidelines, previously issued following the implementation of Directive 2009/136/EC. The guidelines required express consent to be obtained from Internet users by the ticking of a box or the clicking of acceptance to the website’s terms and conditions. Adhering to this strict rule was simply not practical and not adhered to by many websites.

The CNIL is now moving to a more practical and flexible approach, similar to the model adopted in the UK. That is the presumption of consent. Consent will be recognized where there is a notification that cookies are used and the stated purpose, and the user continues to browse the website. Consent will also be presumed once a user views a secondary page on the website. This not only applies to http cookies, flash cookies, invisible pixels and other hidden identifiers.

This presumption of consent to the use of cookies is, of course, not new. But it is a significant step in clarifying what constitutes consent and simplifies the procedure. The CNIL is recommending the use of a banner informing the user that cookies will be installed, the purpose of the cookies, together with a link to oppose or control the cookies. This banner must appear each time the user visits the website until the user “continues browsing”. Cookies can have a life span of no more than 13 months, much longer than the previous guidelines that allowed a lifespan of only 6 months.

If the proposed Data Protection Regulation comes into effect later this year, it will overrule these new guidelines, but for now, continued browsing after being notified that cookies are being used will be a presumption of consent. In its current form, the Data Protection Regulation would require consent be express and definite, a presumption of consent would not be sufficient.