Trackers exempt from consent

This article aims to explain which trackers benefit from the exemption of consent by the French Data Protection Authority (CNIL)

The French Data Protection Authority (CNIL) allows a publisher not to ask consent for some trackers.  

These trackers that don't need consent are:

• Trackers needed to provide a service explicitly asked by the user
• Trackers measuring the audience on the site/app
• Trackers testing different versions to optimize the publisher's needs on its editorial choices depending on their performances

The French Data Protection Authority gave examples of cookies concerned by the exemption of consent.

Regarding the practices that the Commission is informed of, we have: 

• trackers keeping the choice expressed by the user on the deposit of trackers or the will of the latter to not express a choice ;
• trackers intended to authentification to a service ;
• trackers intended to store the content of a shopping basket on a commercial site ;
• personalisation trackers of the user interface (for example, for the choice of the language or the presentation of a service), when such a personalisation represents an intrinsic part that is expected by the user of the service ;
• trackers that make a balancing of the volume of equipments contributing to a communication service ;
• trackers enabling the paid services sites to limit their free access to the content on a preset period/content quantity.
• trackers measuring the audience, in the specific case of the Article 5 of the guidelines about the cookies and other trackers. 

Here's the list fo the conditions to execute to dispense with consent:

• they have to be executed by the publisher of the site or its subcontractor ;
• the person needs to be informed by their execution beforehand ;
• the person must have the possibility to oppose it via a mechanism of opposition that can be used easily on all the terminals, the operating systems, the apps and the web browsers.  No operation of lecture or writing should happen on the terminal from which she opposed ;
• the purpose of the device must be limited to (i) the measurement of audience of the viewed to enable evaluation of contents published and ergonomics on the site/app ; (ii) the - segmentation of the audience of the web site on cohorts to evaluate the efficacité of editorial choices, without needing it to target a unique person ;  (iii) the dynamic and global modification of a website. The personal data collected should not either be cut and cross-checked with other processions (client files or attendance statistics of other websites, for example) neither forwarded to a third party.  The use of these trackers must ado be strictly limited to the production of anonymous statistics. Its scope should be limited to one single  publisher or mobile app, and it must not enable the follow-up of a user's browsing using different apps or browsing on different web sites ;
• the use of the IP address to geo-track the user should not provide any further information than the city. The IP address collected should also be deleted or anonymized once the geo-track has been executed ;
• the trackers used by these processings should not have a duration exceeding  13 months and which shouldn't be extended automatically when having new visits. The info collected via trackers should be keeper for a duration of twenty-five months. 

The cookie can be dropped without consent only if it only serves precise purposes. If it involves other purposes too, it cannot be exempted of consent.