Cookies and similar technologies have become an indispensable part of the digital ecosystem. They ensure the proper functioning of websites, measure their performance and, above all, collect valuable information on users' behaviour for marketing, personalisation or targeted advertising purposes. Long perceived as a mere technical topic, cookies have moved to the forefront of the enforcement priorities of data protection authorities and may expose companies to significant regulatory sanctions and liability if the applicable legal requirements are not properly implemented.
1. Context
In a recent decision of the French data protection authority ("CNIL"), an Irish company belonging to the Shein group was imposed an administrative fine of EUR 150 million for breaching the rules applicable to cookies (link). The decision was subject to appeal and may therefore not yet be final. Beyond its exceptional amount, this sanction sends a clear message: cookie management is no longer a matter of
