The Commission Nationale de l’Informatique et des Libertés in France recently took action against misleading cookie banners as subverting true consent.

This is not a new issue, though, with the Federal Trade Commission, the New York Attorney General and the California Privacy Protection Agency all issuing warnings or taking enforcement actions in recent years.

What practices are we helping clients avoid?

• The opt-out option takes the form of a clickable link whose choices of color, character size and font disproportionately highlight the opt-in option compared to the opt-out option. (Color and size are also called out in the new California Consumer Privacy Act draft regs.)
• The opt-out option is confused with the privacy disclosure because of its location to the point that it is not easily discernible.
• The opt-out option is attached to other paragraphs without sufficient spacing to visually distinguish the opt-out method of the tracers from all the other information brought to its attention.
• The acceptance option is presented several times in the banner while the refusal option is only present once and in terms that aren’t explicit. (“I decline non-essential purposes.”)