The French data protection authority ('CNIL') announced, on 14 December 2021, that it had issued around 30 new compliance orders against organisations for non-compliance with its rules on cookies and similar technologies, once again in relation to the requirement thereunder for cookies to be as easy to reject as they are to accept, in furtherance of its ongoing enforcement campaign on this topic. In particular, CNIL highlighted that the compliance orders follow recent investigations carried out by CNIL, which have shown that:

• cookies subject to consent were automatically deposited in the user's terminal before acceptance by the user, upon arrival on the site;
• information banners are still not compliant because they do not allow the user to refuse the deposit of cookies as easy as it is to accept it; and
• information banners offer the user a means of refusing cookies as easily as accepting them, but the proposed mechanism is not effective because cookies subject to consent are still deposited after the refusal expressed by the user.

In addition, CNIL outlined that the compliance orders concern private, national, and international organisations, as well as public bodies, and that the addressed organisations have one month to comply with the orders.

Finally, CNIL emphasised its powers to fine non-compliant organisations up to 2% of annual worldwide turnover in the event of failure to remediate the identified issues, while also reiterating the long-term nature of this enforcement campaign and noting that it will continue to issue corrective measures to ensure that the privacy of French internet users is respected.

You can read the press release here.