| name | cnil-compliant-cookies |
| title | Implementing CNIL-Compliant Cookies |
| description | Implementation guide for CNIL cookie guidelines compliance. References the EUR 150M Google fine and EUR 60M Meta fine. Covers equal prominence accept/reject buttons, cookie wall prohibition, 6-month reconsent intervals, essential cookies exemption, and detailed CNIL Deliberation No. 2020-091 requirements. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/cnil-compliant-cookies |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | fr |
| practice | data-protection |
| language | en |
Implementing CNIL-Compliant Cookies
Overview
The French Commission Nationale de l'Informatique et des Libertés (CNIL) has been the most aggressive European enforcer of cookie consent rules. In January 2022, CNIL issued a EUR 150 million fine to Google LLC and a EUR 60 million fine to Meta Platforms Ireland Ltd. for cookie consent violations. These enforcement actions, combined with CNIL Deliberation No. 2020-091 (September 17, 2020), establish the most detailed cookie consent standards in Europe.
CNIL Cookie Consent Requirements
1. Equal Prominence of Accept and Reject (CNIL Deliberation 2020-091, Section 2.1)
Requirement: Users must be able to refuse cookies as easily as accepting them. The "Refuse All" option must be presented with the same visual prominence as the "Accept All" option.
Specific CNIL Requirements:
- "Accept All" and "Refuse All" buttons must be on the same hierarchical level (same layer of the interface)
- Both buttons must have comparable visual treatment (size, color, font, position)
- Neither button may be visually promoted or demoted relative to the other
- A "Manage Preferences" option may be offered as a third option but must not replace "Refuse All"
CloudVault SaaS Inc. Implementation:
┌─────────────────────────────────────────────────────────────┐
│ CloudVault uses cookies to improve your experience. │
│ [Learn more about our cookie use] │
│ │
│ ┌──────────────────┐ ┌──────────────────┐ │
│ │ Accept All │ │ Refuse All │ │
│ └──────────────────┘ └──────────────────┘ │
│ │
│ [Manage Preferences] │
└─────────────────────────────────────────────────────────────┘
Button specifications:
- Both: 200x44px, #2563EB blue background, white text, 16px bold
- Position: side by side, same vertical level
- "Manage Preferences": text link below, #6B7280 grey, 14px regular
2. No Cookie Walls (CNIL Deliberation 2020-091, Section 2.2)
Requirement: Access to the website or service must not be conditioned on accepting cookies. Users who refuse all cookies must be able to access the same content and functionality.
Exceptions:
- The CNIL acknowledges that some functionality (e.g., personalized recommendations) may require cookies. In that case, a degraded but functional experience must be available.
- Paywall vs cookie wall: CNIL has indicated (Deliberation No. 2022-003) that offering a paid cookie-free alternative alongside a free cookie-funded option may be permissible under certain conditions (the "pay or consent" model), though this remains contested.
