CNIL and Affiliation: Misunderstanding the Succession of Internet Users?

amphitheater Jean Francois Binet – Associate Advocate MARCEAU AVOCATS & Christopher Busquet – Co-founder of EFFINITY – for CPA (Digital Marketers Group)

20 years lasts! 20 years of trying to explain to anyone who wants to hear what membership is. What makes it specific, nuances, origins, etc. Explain that affiliation is not advertising, that affiliation is a virtuous economic model, based on business contribution pay and not based on personal data… We make it clear to our parents and friends alike… And you can see clearly in their eyes that they want to understand us, if only to please us. . But, in general, the conversation ends with a phrase like “Yes, it’s like advertisements!”. Argh!

We must therefore believe that as long as we do not practice it, belonging cannot be easily tamed. Undoubtedly, the affiliated players have their share of responsibility in this chronic misunderstanding…and yet it provokes outrage.

So how can we be surprised, when the CNIL rightly decides to introduce some regulation of certain advertising practices, which are somewhat extreme for the privacy of Internet users, this affiliation participates in this wonderful spring 2021 cleanup. With the basic justification: “Yes, it’s like advertising! “

So here we are compelled to carry the wand of the pilgrims to try to make audible the dissonant voices of the choir of subordinate actors.

A reminder of the facts

With the desire to allow Internet users to control the data about them, CNIL has implemented, since April 1, 2021, its new guidelines regarding reading and writing operations in the user terminal (cookies, trackers…).

In these Guidelines, the CNIL changes its interpretation of the Data Protection Act in the direction of strengthening the consent of the Internet user, the acquisition of which is necessary in order to carry out these operations.

These Guidelines are specifically intended to regulate the monitoring of Internet users and the collection of their data for the purposes of ad targeting.

For example, in order to know that you have seen a pair of tennis shoes on your favorite e-commerce site, in order to present it to you in an ad banner when browsing on other sites, the e-merchant will have to obtain your approval. Likewise, before we can track the types of content you have consumed on the various media sites, in order to identify you and customize the advertisements that will be shown to you, these media sites must obtain your consent.

It is all part of an understandable approach to privacy protection.

But when the going gets tough, such consent is necessary for all reading and writing practices of the user’s terminal, without regard to the multitude of services offered on the Internet and without regard to whether the purposes of such practices affect the privacy of users.

The law does not provide for an exemption from consent if the purpose of the operation is: “... Strictly necessary to provide an online communication service at the express request of the user. “

CNIL specifies in its guidelines that audience measurements are exempt, provided certain conditions are met, in particular anonymity. But in its March 18, 2021 FAQ, CNIL further clarified by saying that tracking tools needed to bill subsidiaries are generally not exempt from approval.

Affiliation: a mechanism to bring in business that does not aim to follow people but flows

An affiliation consists of a commercial shareholding relationship between the “affiliate company” and the merchant site. The contribution of business generally performed by a broker is recognized by means of tracking tools.

In the context of this relationship, the goal is in no way to track or collect data on the Internet user, but to record the flows of commercial contributions between affiliates and advertisers. The Internet user is nothing but a data medium that does not distinguish him.

Affiliate trackers may be necessary to provide the services requested by Internet users.

Affiliates that participate in this relationship mostly provide services to Internet users: cashback, discount codes, wish list, tests, comparisons, etc.

However, in its FAQ, CNIL states that affiliation tracking tools “is not strictly necessary to provide an online communication service expressly requested by the user”.

This general statement negates the fact that Internet users voluntarily go to affiliate sites to search for the service.

Let’s take three examples:

  • Cashback Sites and Reward Representatives: A voluntary approach for an Internet user who has registered with these sites and who knows that their purchase on the merchant site will be linked to the cashback site

The cookie is absolutely necessary to the operation and is done at the express request of the user: why is this action not exempt from consent?

  • Coupon sites: A voluntary approach of an Internet user who goes to look for a code on one site to put it on another.
  • Shopping guides and comparisons: a voluntary approach to the Internet user searching for content (tests, best prices, reviews, comparisons, etc.)

Moreover, according to the CNIL interpretation, audience measurement is absolutely essential and therefore excluded from consent. Affiliation is only an exploitation of statistical data to measure the audience, so it should be able to take advantage of it. Especially since Article 82 of the Data Protection Act on which CNIL is based does not require that what is strictly necessary for the provision of an Internet communication service has the exclusive purpose of providing this service.

This attitude leads to economic nonsense

It is recognized that for some of these Representatives it may be debated whether a cookie is strictly necessary for the service to be provided to them. However, if this service is offered free of charge to the user, it is because the publisher of the service receives the income related to the affiliation.

From this point of view, affiliate trackers are essential to the service’s existence. In fact, CNIL’s position is to say that user consent must be required to reward the business provider. Do we ask the apartment buyer for permission that the seller compensate the real estate agency? This is economic nonsense.

This position is exaggerated in relation to the goal of protecting privacy and can be counterproductive

This position has little or no effect from a privacy perspective because the purpose of affiliation is not to track or collect information about individuals.

Moreover, it can have a harmful effect. We are already watching it! More and more sites are implementing paywall. Thus, the choice offered to the Internet user becomes simple: pay to access content or accept cookies, not only those of the affiliation … but also all others (some of which are likely to be intrusive).

In the same way that the CNIL makes clear in its guidelines that the legality of wall cookies should be analyzed on a case-by-case basis, the way in which the different types of affiliated actors should adhere should be analyzed on a case-by-case basis. Status depending on the services they provide and not fall into the general qualification.

This generalization can, in the long run, impoverish the services offered today free of charge to Internet users.

Photo by Zakaria Ahada on Unsplash

Leave a Comment