back button


My take on the CNIL’s new guidelines on cookies: 4 key ideas to remember

April 16, 2020byRomain Gauthier

The new CNIL (France’s privacy watchdog) guidelines released in the summer of 2019 have turned the advertising industry upside down and are prompting us to rethink how we monetize information and innovate in programmatic. On June 28th, the CNIL (which means National Commission for Information Technology and Civil Liberties) published its action plan on advertising targeting, one year after GDPR came into force and before the adoption of a new European directive on the subject, called ePrivacy.

Its purpose is to inform operators on the practical methods for collecting the consent of internet users. The main novelties are twofold: firstly, the mere continuation of navigation on a site can no longer be considered as a valid expression of consent to the deposit of cookies, and secondly, operators who use cookies must be able to prove that they have indeed obtained consent. French sites will thus have a few months to comply by requesting and collecting explicit consent from their visitors if they wish to place cookies.

On this subject, I was invited by The Programmatic Society to participate in a debate entitled “Decision of the CNIL on the use of cookies: what impact on the advertising market?” I had the chance to discuss with Merav Griguer, attorney partner at Bird & Bird, Julie Walther, COO and co-founder of Qwarry, and Thomas Masereel, Yield and Programmatic Manager at MEDIA.figaro. Here is what I take away from this discussion in 4 points.

Here the full video, sub-titled in English:

  1. The changes imposed by the new CNIL directives provide necessary clarifications for all stakeholders

We all agreed that these new directives are beneficial and necessary, as they provide the clarification that all players in the advertising industry were waiting for. It was essential to provide a balanced solution, taking into account the needs of internet users, of course, but also those of publishers and professionals in the sector. We can now better understand and anticipate the world that is opening up to us from September onwards.

Of course, the industry will have to adapt. There will be fewer cookies used for advertising purposes and the consent rate will be lower than the 95% that we see on some sites today (as I said in a webinar recently). But this is an opportunity to innovate and explore new forms of monetization. No need to panic, this is not the end of all cookies, it’s simply the end of the reign of cookies as the prevailing state of affairs.

On the other hand, it is certain that these imposed changes will have a big impact on companies, and in particular, in a very practical way, on their design. They will have to offer a perfect symmetry of choice to Internet users, between accepting or refusing cookies, without influencing them by a design based on dark patterns. Given the number of visitors that some websites receive every day, the need to effectively manage the consent collection process is paramount. A Consent Management Platform (CMP) greatly facilitates this collection and ensures compliance with GDPR, CNIL, and e-Privacy from the outset.

  1. Programmatic and personalized advertising have not said their last word

Some people fear the end of programmatic and personalized advertising. The CNIL is said to be responding to a political objective of attacking targeted advertising in order to return to contextual advertising, which is considered to be more acceptable on a societal level because it collects less data. They believe it is a purely political move, based on no business or technological grounds. 

The reality is that our industry is very adaptable. It already had to make adjustments at the end of 2018 following a formal notice regarding geolocation data that forced players to revise the way in which consent was collected. It will be the same this time. The CNIL’s directives do not imply the end of consent, but rather opportunities to reflect on the fundamental questions surrounding this notion (when, how, where to ask for consent…).

Contextual targeting is an interesting alternative among others to cookie collection, but the results are variable and it is not to everyone’s taste. The important thing is to open the field of possibilities, to innovate, and that’s very interesting and stimulating for us publishers! Indeed, giving users more choices and keys to understanding while engaging publishers and their partners in a deep reflection on how to get the best possible results is a good thing.

So even if the cookie is currently the means of communication used by all industry players to decide whether or not to buy or sell advertising impressions, the intrinsic functioning of the programmatic via the RTB is intelligent and can be adapted to other forms of data.

One thing seems clear to me: using fewer cookies will not change the fact that RTB (Real Time Bidding) is essential. It will certainly change the way auctions are purchased, with on the one hand, a series of auctions that will be personalized (with strong consent for all actors in the chain), and on the other hand, non-personalized auctions (based on contextual targeting where a series of innovations can occur). But in all cases, the real-time arbitrage capacity offered by the programmatic infrastructure is essential and will not disappear.

  1. The threat comes from Google: the end of third party cookies?

Even if the new CNIL directives lead to a number of changes, it’s no revolution. In practice, it has already been possible to measure the impact of consent on all programmatic auction systems: studies show that a non-personalized printout yields on average 52% less than a personalized printout. We have some figures to build on.

On the other hand, when Google announced the end of cookies in its Chrome browser by 2022, it set off a bombshell in the global advertising industry. Because while we already have the tools to project ourselves into a world where there will be less user consent, we do not yet have the ability to project ourselves into a world where there are no more third-party cookies. This means not only losing our ability to target, but also to measure (capping, performance, attribution), which are at the heart of the programmatic model. These are inseparable from the idea of personalized programming, and on that, we are still in the dark.

Google’s Privacy Sandbox aims to offer both ad targeting and privacy, but the problem is that we don’t know exactly how it will work, so we can’t start developing applications to accommodate it. There’s a lack of information to start working on concrete specifications for new browsers, which generates legitimate concern.

Above is one of the slide’s of a webinar I recently held on the the topic. Click on the image to watch it on YouTube

Many players thus feel threatened by Google’s announcement, because we’re dealing here with the monetization of media sites, and therefore a lot of jobs. In particular, the entire media and journalism industry is impacted because cookies are an essential source of their funding. We will have to expect, as in any transition period, that some players will disappear and others will emerge. This is a classic Schumpeterian movement. But the players in the sector will be accompanied in their transition so that they can transform the threat into an opportunity to reinvent themselves.

  1. A new advertising ID as an alternative to cookies

I do not think that there are realistic alternatives to cookies to date, as there is not yet an alternative commonly accepted by all stakeholders, which is properly specified so that everyone can make good use of it.

Several solutions are possible: contextual targeting, content of interest to the user that requires a login or the acceptance of conditions to access this content, new identifiers that are more relevant and less intrusive than the cookie… The most credible solution in my opinion is a new advertising identifier, which would no longer be a cookie but would be attached to the email or phone number of Internet users.

In any case, the solution must be thought out with the user in mind, who must always be able to make informed choices and understand the use that is made of his or her personal information. We are moving away from the principle of personalization for everyone, all the time. With the implementation of a CMP, any website has the ability to inform visitors about the types of data it will collect, to ask for their consent, and to meet French and EU regulatory requirements regarding the collection of consent.

At Didomi, we think ahead in terms of respecting people’s choices: there is no reason why we shouldn’t make it as simple and effective as possible to manage personal data, whether you are a brand or a publisher. To deny this is to deny the future: so let’s innovate, let’s be ambitious, and let’s step into the future!

Related articles

November 22, 2018byJawad Stouli

What CMPs can learn from the French data protection authority

On 30 October 2018, the French Data Protection Authority (the “CNIL”) issued a warning against a small company called Vectaury in relation to how this Ad Tech actor was collecting consent for geolocation-based advertising campaigns. On 8 November 2018, it decided to make this decision public notably because it is necessary to “raise awareness among…

Read more











May 15, 2020byJawad Stouli

Get CCPA ready with the Didomi consent management platform (CMP)

The California Consumer Privacy Act (CCPA) was enacted to provide California consumers with greater transparency and control over their personal information. The CCPA was created in response to changing public perceptions. Users, rightfully, want to understand and have the option to exercise control over their own data. Therefore, companies in the ad tech ecosystem need…

Read more




April 20, 2018byRomain Gauthier

Didomi now supports the IAB Europe consent framework

Didomi is proud to announce that our Consent Management Platform (CMP) is now officially registered with the IAB Europe’s GDPR consent framework. We’re one of the first CMPs to fully support the framework. The IAB Europe Consent Framework The IAB Europe Consent Framework aims at standardizing consent flows between advertising partners. Online advertising involves a…

Read more






tailored advertising

targeted advertising

May 13, 2020byYannig Roth

Didomi’s CMP has been approved as TCFv2-compliant (migration cut-off date now is August 15th)

We have announced yesterday that our Consent Management Platform (CMP) has successfully passed the IAB Europe’s CMP Compliance Programme (see the full list here). Many clients have started to transition to the TCF’s version 2 already, and all IAB members will have to update their websites and mobile apps to support it until the summer 2020.

Read more




TCF v2

May 5, 2020byYannig Roth

« Do I need to collect consent? » – Mythbusting marketing obligations in a GDPR and CCPA era

Any marketer even remotely interested in the legal landscape around 2016 heard all sorts of discourses about GDPR. The regulation would be the end of newsletters, of solicitations, of targeted advertising. Companies would face tremendous fines if they failed to become compliant within a year. Two years after GDPR came into effect, marketing still exists…

Read more




Preference Center