Consent exemption according to the CNIL

👋 The article discusses the CNIL exemption in France for the use of audience measurement trackers without consent or prior information, under certain conditions. In particular, the data collected must be anonymous and may not be shared with third parties. The document provides guidelines for compliance and user data protection.

The management of a website or mobile application often requires the analysis of traffic and performance statistics. Cookies are commonly used for this purpose. However, it is possible to use cookies without asking for the user's consent in certain situations.

When can cookies be used without consent?

To be exempt from the requirement to obtain consent, in accordance with Article 82 of the French Data Protection Act, cookies must :

1. Be used exclusively to measure the audience or performance of the site or application.

2. Provide anonymous statistics only.

☝ These cookies must not merge data with other sources or share it with third parties, nor allow complete tracking of the user's browsing across different sites or applications.

Advice from CNIL

To respect the rights of individuals, the CNIL suggests that :

• Users are informed of the use of cookies, for example via the privacy policy.

• Cookies have a limited lifespan of 13 months, with no automatic renewal on subsequent visits.

• The information collected by these cookies will be kept for a maximum of 25 months.

• Retention periods are regularly reassessed to ensure they remain relevant.

An external service provider may provide an audience measurement service to several publishers, as long as the data is processed separately for each publisher and the cookies used are independent.

⚠️ Some audience measurement tools are not exempt. It is therefore essential to check with the supplier that the data will not be reused. In addition, you need to be vigilant about any data transfers outside the EU by the supplier.

CNIL evaluation of the Tools

The CNIL has set up a program to identify tools that can be configured to be exempt from consent. Several solutions have been identified, including Analytics Suite Delta, SmartProfile, Wysistat Business, and others.

When are cookies exempt from consent? In order to be limited to what is strictly necessary for the provision of the service, and thus exempt from consent in accordance with article 82 of the French Data Protection Act, these tracers must : Cookies: solutions for audience measurement tools

Essential measures According to the CNIL :

In general, the CNIL considers that the following measures are strictly necessary to ensure the proper administration of a site:

• audience measurement, by page ;

• list of pages from which a link has been followed to request the current page (referrer), internal or external to the site, by page and aggregated daily ;

• type of terminal, browser and screen size of visitors, per page and aggregated daily;

• page load time statistics, by page and aggregated hourly ;

• statistics on time spent on each page, bounce rate, scroll depth, per page and aggregated daily;

• statistics on user actions (click, selection), by page and aggregated daily ;

• statistics on the geographic zone of origin of requests, by page and aggregated daily.

To ensure that tools are correctly configured, the CNIL requests a detailed list of settings and options. Without this, the CNIL may refuse the request. Other measures may meet CNIL criteria, but it is up to the site administrator to provide the necessary documentation.

☝ BeliefsWe do not recommend the implementation of consent-exempt solutions.
‍Firstof all the operating and analysis capabilities are extremely reduced. It's better to operate on a sample of data subject to consent. What's more, poor implementation can result in sanctions and damage to the company's reputation.