The Conseil d'Etat ('the Council') issued, on 19 June 2020, a decision partially annulling the French data protection authority's ('CNIL') guidelines on cookies and other trackers ('the Guidelines'), with CNIL issuing a statement ('the CNIL Statement') on the same. In particular, the Council found that CNIL could not legally include a ban on 'cookie walls,' which is the practice of blocking access to a website or a mobile app for those who do not consent to the use of cookies and other trackers. More specifically, the Council reasoned that, while the requirement of free consent to the use of cookies is enshrined in the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), by imposing a blanket prohibition on cookie walls based on the principle of free consent, CNIL had exceeded its legal powers in the context of guidelines, which consist of 'flexible law.' Therefore, the Council stated that the fourth paragraph of Article 2 of the CNIL's decision of 4 July 2019 adopting the Guidelines is annulled.  

Conversely, the Council rejected the applicants' argument that the Guidelines impose specific procedures for obtaining consent. In this regard, the Council upheld the Guidelines' provision on giving users specific information before obtaining consent for specific types of processing on the basis that it complies with the preexisting legal requirement that users' consent to cookies must relate to the purposes behind the processing. Moreover, the Council also upheld the Guidelines' provisions on the ease of withdrawing consent to cookies and on informing users about cookies in order to ensure certainty that, by providing for these requirements, CNIL has not imposed a new information obligation unfounded in law. Lastly, the Council ordered CNIL to pay the applicants €3,000 under Article L. 761-1 of the Code of Administrative Justice. 

In relation to the above, the CNIL Statement responds that CNIL will comply with the Council's decision and will adjust the Guidelines based on the same. Moreover, the CNIL Statement notes that the Guidelines will adopt a recommendation on the methods for collecting consent to cookies after September 2020. 

You can read the press release here, the decision here, and the CNIL Statement here, all only available in French. 

UPDATE (29 June 2020) 

CNIL publishes English translation of its statement

CNIL published, on 29 June 2020, an English translation of the CNIL Statement.

You can read the English translation here.