Schedule a demo
back button

Back

My take on the CNIL’s new guidelines on cookies: 4 key ideas to remember

April 16, 2020byRomain Gauthier

The new CNIL (France’s privacy watchdog) guidelines released in the summer of 2019 have turned the advertising industry upside down and are prompting us to rethink how we monetize information and innovate in programmatic. On June 28th, the CNIL (which means National Commission for Information Technology and Civil Liberties) published its action plan on advertising targeting, one year after GDPR came into force and before the adoption of a new European directive on the subject, called ePrivacy.

Its purpose is to inform operators on the practical methods for collecting the consent of internet users. The main novelties are twofold: firstly, the mere continuation of navigation on a site can no longer be considered as a valid expression of consent to the deposit of cookies, and secondly, operators who use cookies must be able to prove that they have indeed obtained consent. French sites will thus have a few months to comply by requesting and collecting explicit consent from their visitors if they wish to place cookies.

On this subject, I was invited by The Programmatic Society to participate in a debate entitled “Decision of the CNIL on the use of cookies: what impact on the advertising market?” I had the chance to discuss with Merav Griguer, attorney partner at Bird & Bird, Julie Walther, COO and co-founder of Qwarry, and Thomas Masereel, Yield and Programmatic Manager at MEDIA.figaro. Here is what I take away from this discussion in 4 points.

Here the full video, sub-titled in English:

  1. The changes imposed by the new CNIL directives provide necessary clarifications for all stakeholders

We all agreed that these new directives are beneficial and necessary, as they provide the clarification that all players in the advertising industry were waiting for. It was essential to provide a balanced solution, taking into account the needs of internet users, of course, but also those of publishers and professionals in the sector. We can now better understand and anticipate the world that is opening up to us from September onwards.

Of course, the industry will have to adapt. There will be fewer cookies used for advertising purposes and the consent rate will be lower than the 95% that we see on some sites today (as I said in a webinar recently). But this is an opportunity to innovate and explore new forms of monetization. No need to panic, this is not the end of all cookies, it’s simply the end of the reign of cookies as the prevailing state of affairs.

On the other hand, it is certain that these imposed changes will have a big impact on companies, and in particular, in a very practical way, on their design. They will have to offer a perfect symmetry of choice to Internet users, between accepting or refusing cookies, without influencing them by a design based on dark patterns. Given the number of visitors that some websites receive every day, the need to effectively manage the consent collection process is paramount. A Consent Management Platform (CMP) greatly facilitates this collection and ensures compliance with GDPR, CNIL, and e-Privacy from the outset.

  1. Programmatic and personalized advertising have not said their last word

Some people fear the end of programmatic and personalized advertising. The CNIL is said to be responding to a political objective of attacking targeted advertising in order to return to contextual advertising, which is considered to be more acceptable on a societal level because it collects less data. They believe it is a purely political move, based on no business or technological grounds. 

The reality is that our industry is very adaptable. It already had to make adjustments at the end of 2018 following a formal notice regarding geolocation data that forced players to revise the way in which consent was collected. It will be the same this time. The CNIL’s directives do not imply the end of consent, but rather opportunities to reflect on the fundamental questions surrounding this notion (when, how, where to ask for consent…).

Contextual targeting is an interesting alternative among others to cookie collection, but the results are variable and it is not to everyone’s taste. The important thing is to open the field of possibilities, to innovate, and that’s very interesting and stimulating for us publishers! Indeed, giving users more choices and keys to understanding while engaging publishers and their partners in a deep reflection on how to get the best possible results is a good thing.

So even if the cookie is currently the means of communication used by all industry players to decide whether or not to buy or sell advertising impressions, the intrinsic functioning of the programmatic via the RTB is intelligent and can be adapted to other forms of data.

One thing seems clear to me: using fewer cookies will not change the fact that RTB (Real Time Bidding) is essential. It will certainly change the way auctions are purchased, with on the one hand, a series of auctions that will be personalized (with strong consent for all actors in the chain), and on the other hand, non-personalized auctions (based on contextual targeting where a series of innovations can occur). But in all cases, the real-time arbitrage capacity offered by the programmatic infrastructure is essential and will not disappear.

  1. The threat comes from Google: the end of third party cookies?

Even if the new CNIL directives lead to a number of changes, it’s no revolution. In practice, it has already been possible to measure the impact of consent on all programmatic auction systems: studies show that a non-personalized printout yields on average 52% less than a personalized printout. We have some figures to build on.

On the other hand, when Google announced the end of cookies in its Chrome browser by 2022, it set off a bombshell in the global advertising industry. Because while we already have the tools to project ourselves into a world where there will be less user consent, we do not yet have the ability to project ourselves into a world where there are no more third-party cookies. This means not only losing our ability to target, but also to measure (capping, performance, attribution), which are at the heart of the programmatic model. These are inseparable from the idea of personalized programming, and on that, we are still in the dark.

Google’s Privacy Sandbox aims to offer both ad targeting and privacy, but the problem is that we don’t know exactly how it will work, so we can’t start developing applications to accommodate it. There’s a lack of information to start working on concrete specifications for new browsers, which generates legitimate concern.

Above is one of the slide’s of a webinar I recently held on the the topic. Click on the image to watch it on YouTube

Many players thus feel threatened by Google’s announcement, because we’re dealing here with the monetization of media sites, and therefore a lot of jobs. In particular, the entire media and journalism industry is impacted because cookies are an essential source of their funding. We will have to expect, as in any transition period, that some players will disappear and others will emerge. This is a classic Schumpeterian movement. But the players in the sector will be accompanied in their transition so that they can transform the threat into an opportunity to reinvent themselves.

  1. A new advertising ID as an alternative to cookies

I do not think that there are realistic alternatives to cookies to date, as there is not yet an alternative commonly accepted by all stakeholders, which is properly specified so that everyone can make good use of it.

Several solutions are possible: contextual targeting, content of interest to the user that requires a login or the acceptance of conditions to access this content, new identifiers that are more relevant and less intrusive than the cookie… The most credible solution in my opinion is a new advertising identifier, which would no longer be a cookie but would be attached to the email or phone number of Internet users.

In any case, the solution must be thought out with the user in mind, who must always be able to make informed choices and understand the use that is made of his or her personal information. We are moving away from the principle of personalization for everyone, all the time. With the implementation of a CMP, any website has the ability to inform visitors about the types of data it will collect, to ask for their consent, and to meet French and EU regulatory requirements regarding the collection of consent.

At Didomi, we think ahead in terms of respecting people’s choices: there is no reason why we shouldn’t make it as simple and effective as possible to manage personal data, whether you are a brand or a publisher. To deny this is to deny the future: so let’s innovate, let’s be ambitious, and let’s step into the future!

Related articles

November 22, 2018byJawad Stouli

What CMPs can learn from the French data protection authority

On 30 October 2018, the French Data Protection Authority (the “CNIL”) issued a warning against a small company called Vectaury in relation to how this Ad Tech actor was collecting consent for geolocation-based advertising campaigns. On 8 November 2018, it decided to make this decision public notably because it is necessary to “raise awareness among…

Read more

CMP

CNIL

Consent

Cookies

France

GDPR

IAB

Sanction

Vectaury

Warning

July 1, 2020byYannig Roth

Are your websites and apps compliant? A look at Irish cookie consent regulation

Last April, the Irish Data Protection Commission (DPC) published updated guidance on cookies and other tracking technologies. The “Guidance” was issued with a report based on a cookie audit of 38 companies, and the results of the audit were not good. The survey found that 35 of the 38 companies were not in compliance on…

Read more

CMP

compliance

Consent

Cookies

GDPR

July 20, 2020byYannig Roth

What are the requirements of a TCF v2 compliant consent notice?

On a website or in a mobile app, the notice is the first and main consent UI that users interact with. That’s where most users get informed on purposes and vendors that consent is collected for, and how users will make a choice to give or deny consent. As a result, the content of a consent…

Read more

CMP

Consent

GDPR

TCF v2

July 15, 2020byYannig Roth

Google joining TCF v2… Here’s what it means for publishers

The IAB Tech Lab and IAB Europe released the second version of the Transparency & Consent Framework (TCF v2), marking a big win in terms of industry traction, as Google has announced that it will integrate the framework by August 15th 2020. Now that Google Ad Manager (Google’s Supply Side Platform, or SSP) is joining the TCF,…

Read more

CMP

Consent

IAB

TCF v2

July 1, 2020byYannig Roth

Are your websites and apps compliant? A look at UK cookie consent regulation

In July 2019, the Information Commissioner’s Office (ICO) published new guidance on the use of cookies to provide more clarity and certainty about how you can use cookies in your online service. As the Information Commissioner said, “the public has woken up to the potential of their personal data”, adding that “the ICO has covered an…

Read more

CMP

Cookies

GDPR