The French data protection authority ('CNIL') published, on 16 May 2022, its guidance outlining criteria for assessing the legality of cookie walls, i.e. the practice of conditioning access to a service on the acceptance, by the internet user, of the deposit of cookies or similar tracking technologies on their terminal device. In particular, the guidance follows the Council of State's decision of 19 June 2020 which held that CNIL could not impose a blanket ban on the use of cookie walls, as it had intended in the first version of its guidelines on cookies and similar trackers ('the Cookie Guidelines'), which consequently do not generally prohibit such practices in their final effective version. In this Insight article, we take a closer look at the criteria set out by CNIL, whilst also positioning the guidance in the broader context of the complex regulatory dynamics surrounding cookie walls.

The French data protection authority ('CNIL') published¹, on 16 November 2021, a practical guide on the data protection officer² ('DPO'), notably under Article 37 to 39 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and Articles 57 and 103 of the Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR). Four sections of the Guide cover the role of the DPO, the designation of the DPO, the exercise of the tasks of the DPO, and support for the DPO by CNIL. As well as reiterating pertinent provisions of the GDPR regarding the central topics, CNIL incorporates best practices into its guide through practical examples and case studies, of which this Insight article provides an overview.