Cookie Wall & Paywall – Do’s and Don’ts

Is a website’s editor able to block access to the Internet user who rejects the storage of cookies or other tracking tools? Is the website’s editor allowed to require the Internet user, as an alternate solution, to make a payment?

The French Data Protection Agency (CNIL) has recently issued Guidelines to set forth the main principles to be complied with by a website’s editor who intends to use Cookie Wall and Paywall.

The use of cookies or tracking tools – the applicable rules

The use of tracking tools is prohibited unless the processing of data can be based on a legal exemption. As a result, only consent and legitimate interests can legitimize the use.

An exemption from the consent requirement is made for technical storage that is strictly necessary to provide the website service explicitly requested by the user of a website (e.g., cookies which are stored for the provision of a shopping cart function).

The cookies which are used in the context of tracking and analysis tools are not necessary for the operation of the website, and therefore require a consent from the Internet user.

 What is a Cookie Wall? What is a Paywall?

A Cookie Wall aims at blocking the access to the content of a website for Internet users who do not accept the storage of cookies, or the reading of cookies already implemented by the website’s editor. Usually, a banner featured on the home page allows the Internet user to click on the "I accept cookies" button. Otherwise, the access to the content of the website is impossible.

Some websites have resorted, in case cookies/tracking tools are rejected by the Internet users, to the implementation of Paywall which is a method of restricting access to content, with a purchase or a paid subscription (especially news or weather forecasts). By doing so, the editors of these websites seek to compensate the loss of advertising revenues because of the lack of use of tracking tools.

On June 19, 2020, the Conseil d’Etat (French Supreme administrative court) held that the “prior-consent” rule does not lead per se to a total ban of Cookie Walls; according to the Conseil d’Etat, the freedom of consent of the data subject must be assessed on a case-by-case basis, in particular in light of the existence of a real satisfactory alternate solution offered by the website’s editor in the event cookies/tracking technologies are rejected by the data subject.

The CNIL has been regularly questioned about the legality of Cookies Wall and Paywall. It has recently issued Guidelines (which implement the aforementioned decision) pending the enactment of the future European "ePrivacy" regulation.

General principles

The rules set forth by the General Data Protection Regulation ((EU) 2016/679) apply to any data processing related to the use of a Cookie Wall or a Paywall.

Particular attention must be paid to the information provided to the data subject as well as to the issue of data transfers outside the European Union.

Does the Internet user who rejects cookies have a fair alternative to access the content?

The CNIL recommends that, when the Internet user refuses the use of cookies on a website (for example by clicking on a "reject all" button), the website’s editor offers a real and fair alternative that allows access to the website and that does not require consent to the use of personal data.

Otherwise, the editor must be able to demonstrate that its service is also accessible on another website without a Cookie Wall. In this case, the CNIL recommends that the website’s editor using a Cookie Wall ensures that this alternative is easily accessible to the Internet user, to avoid any imbalance between the Internet user and the editor, which could deprive the latter of a real choice.

This could be the case, according to the CNIL, when the editor has an exclusivity for the provision of content or services (for example, an administrative/State service must not condition the access to an e-procedure to the acceptance of cookies not necessary to the operation of the website) or when the Internet user has few or no alternatives to the service and therefore has no real choice in the use of cookies, for example in the case of key player/service provider.

 Paywall: a fair price?

A website’s editor is entitled to make access to its content conditional on the acceptance of tracking tools that contribute to the remuneration of its service, or on the payment of a sum of money, insofar as it constitutes an alternative to the consent to tracking tools. However, this monetary consideration must not be such as to deprive the Internet users of a real choice, i.e., the price/compensation must be “fair” (the assessment is made on a case-by-case basis).

The CNIL does not (want to) set a threshold below which a fee is deemed “fair”. But the website’s editor who wishes to implement a Paywall will have to be able to evidence the fairness of the fee. The CNIL encourages website’s editors to publish their analysis/assessment to provide the Internet user with as clear information as possible.

The CNIL provides for some guidance though: the website’s editor must take into account the way its services are used when assessing the compensation requested to the Internet user ; alternate solutions may be found to avoid requesting the Internet user to pay a subscription fee : for instance, one could implement an ad hoc access to a service upon the payment through a virtual wallet (e.g. Paypal, Apple Pay, Google Pay, etc.), so to that the Internet user is not required to store his or her credit card’s details with the website’s editor. 

Further, some websites’ editors require the Internet users to create a “user account”. According to the CNIL, the editors will have to ensure that such an obligation is grounded by the intended purpose: this will be the case, for example, when the “user account” allows the Internet user who has registered for a subscription (monthly or annual), to benefit from this subscription on other devices.

May a Cookie Wall or a Paywall systematically impose the acceptance of all tracking tools?

The freedom of choice of the Internet user (and thus the validity of his/her consent) may be altered if he/she is not offered the possibility to accept or reject tracking tools purpose by purpose.

It is not forbidden to condition access to the website on consent to one or more purposes of the tracking tools, but the website’s editor must be able to evidence that its Cookie Wall is limited to those purposes that allow fair payment for the service offered. For example, if the website’s editor considers that the remuneration of its service relies on the revenues it could get from targeted advertising, only the consent to this purpose should be necessary to access the service: the refusal of other purposes (personalization of the editorial content, etc.) should not then prevent access to the content of the site. Indeed, targeted advertising and personalization of editorial content are two different purposes that must be distinguished when determining the purposes for which access to the service is granted.

Hence, the website’s editor must clearly inform the Internet users of the purposes for which consent is necessary - or not - to access the service.

The user chooses paid access without accepting the storage of cookies: in which (limited) cases may cookies still be stored?

As a general principle, no tracking tool (other than those necessary for the operation of the website) must be stored on the device of the Internet user who has rejected these cookies and chosen the alternative offered by the website’s editor.

However, access to content hosted on a third-party website (e.g., a video) or to a service requested by the user (e.g., access to a content sharing button on social networks) may sometimes result in the storage of tracking tools (in particular for advertising purposes) by this third-party website.

In this case, the Internet user's consent could be gathered at the time he/she activates the content, for example, within a dedicated banner to be displayed on the website. This banner will have to contain specific information, such as:

• the fact that the activation of the external content, or the use of the sharing buttons, requires consent to the storage of tracking tools,
• the purpose of the use of these tracking tools with a link (in French language) to the Privacy Policy of the provider of this external content,
• the consequence of the lack of consent to the storage of cookies, including the impossibility to access to the external content.

 Of course, the Internet user must at any time be able to easily withdraw his/her consent.

Conclusion

On December 31, 2021, the CNIL fined GOOGLE a total of 150 million euros (90 million euros for GOOGLE LLC and 60 million euros for GOOGLE IRELAND LIMITED) because users of google.fr and youtube.com was not able to easily refuse or accept cookies.

A website’s editor who intends to use Cookie Wall and Paywall systems should pay attention to the aforementioned Guidelines pending the enactment of the future European "ePrivacy" regulation.