The French Data Protection authority publishes action plan on online advertising

Online advertising is one of the sectors most affected by the entry into force of the General Data Protection Regulation (GDPR), particularly regarding the requirements for the installation of cookies and users’ prior consent (opt-in) for online advertising.

In order to ensure that French online service providers comply with the obligations of the GDPR, the Commission Nationale de l’Informatique et des Libertés (“CNIL”) has published an action plan for 2019-2020 divided into two phases.

In the first phase, the CNIL will repeal its 2013 recommendation on cookies, which has become outdated in some respects—especially with regard to consent requirements. Data controllers will have 12 months to implement the new guidelines after their publication. The CNIL will continue to monitor that cookies are installed only after obtaining consent from the users.

The second phase includes a consultation period with interested parties (publishers, advertisers, service providers and intermediaries in the adverising industry, etc.) to prepare new guidelines with practical recommendations on consent for online commercial communications. The CNIL will carry out new inspections to verify the correct implementation of these guidelines after 6 months of their final publication.

At a domestic level, service providers established in Spain are fully affected by the obligations of the GDPR. It is therefore advisable to follow the initiatives and recommendations of the Spanish Data Protection Agency (AEPD).

By Sergi Gálvez and Albert Agustinoy