FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
ver (or 5% in the case of a repeat infringement within the statutory period). Regarding the EU Data Act, a French DDADUE bill currently under parliamentary examination proposes to designate ARCEP as the competent authority for enforcement, with the exception of Chapter VII. At the time of writing, this bill has not yet been adopted. The CNIL remains the supervisory authority for GDPR matters. For example, if a cloud-switching failure results in a personal data breach, the CNIL is compe - tent for the GDPR aspects (eg, security and breach notification), while ARCEP may address any breach of cloud-switching obligations within its remit. The SREN Law establishes co-ordination mechanisms – ARCEP must consult the CNIL for certain decisions concerning data intermediation services involving per - sonal data and must refer suspected anti-competitive practices in cloud markets to the French Competition Authority. These arrangements ensure institutional co- ordination but do not create a unified tripartite regula - tory regime. Legal Framework: ePrivacy Implemented in France In France, the placement or reading of cookies and similar trackers on a user’s terminal equipment is gov - erned by the ePrivacy framework (Directive 2002/58/ EC, Article 5 (3)) as implemented by Article 82 of the French DPA. As a rule, storing or accessing informa - tion on a device requires the user’s prior informed con - sent, unless a narrow exemption applies (eg, trackers that are “strictly necessary” for providing a service are expressly requested by the user or required to enable core site functionality). Consent Standard and Practical Design CNIL guidance has established demanding expecta - tions for consent interfaces: users should be able to refuse as easily as accept; consent must be specific and granular; and withdrawal must be possible at any time with an effect comparable to refusal. Organisa - tions must also be able to evidence consent, docu - 4. Sectoral Topics 4.1 Use of Cookies
ment retention periods, and manage third‑party track - ers through contract and technical controls (eg, a consent management platform, tag governance, and auditing). Cookie Walls and Conditional Access Following French and EU case law developments, cookie walls are not automatically unlawful, but they raise a high bar: the user must have a genuine, free choice and must not be coerced into consenting, tak - ing into account the service’s market position and the availability of alternatives. In practice, many services in France avoid blanket “take it or leave it” consent models and implement alternatives (eg, contextual advertisements, paid access, or reduced tracking options), coupled with clear information. Enforcement Exposure Cookies and tracking remain one of the CNIL’s highest enforcement priorities, including for foreign platforms targeting French users. This means that even techni - cally “minor” consent design issues (lack of promi - nence symmetry between options, unclear purposes, or continued reading of cookies after withdrawal) can lead to significant regulatory risk. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised or targeted advertising is regulated through a combination of the GDPR (eg, legal basis and restriction on profiling where it is associated with automated decision-making), the ePrivacy Directive (consent for trackers and electronic marketing), and the new DSA/SREN Law transparency rules. Profiling Restrictions Article 22 of the GDPR strictly regulates decisions based solely on automated processing, particularly profiling, when they produce legal effects or have similar significant impacts on an individual. As a rule, every person has the right not to be subject to such automated decisions. Exceptions apply only when the decision is necessary for a contract, authorised by EU or member state law, or based on the individual’s explicit consent. In these cases, the controller must implement safeguards, including human intervention, the possibility to present one’s viewpoint, and the right to contest the decision. Moreover, automated
124 CHAMBERS.COM
Powered by FlippingBook