FranceLoi Informatique et Libertés Articles 20, 124-4 and 124-5, CNIL Supervision of Online Platform Providers' Advertising Duties under the Digital Services Act
In force since .
A transparency and process rule binding private bodies.
- Obligation class
- Disclosure, Consent
As of .
What it requires
- If you run an online platform with its main establishment in France, or whose legal representative resides or is established in France, comply with Article 26(1)(d) of the Digital Services Act on informing recipients about the advertising shown on your online interface.
- Comply with Article 26(3) of the Digital Services Act, which bars advertising based on profiling with the special categories of personal data listed in Article 6(I) of the Loi Informatique et Libertés, and with Article 28(2), which bars presenting advertising based on profiling to minors.
- Comply with an injunction of the CNIL's restricted committee to bring the service into compliance with those articles, and with any commitment you proposed that the CNIL's president made binding.
If you get it wrong
Penalty structure
Article 20(V) caps the administrative fine for breaching Article 124-5 at 6 % of worldwide turnover for the preceding financial year, and at 1 % for failing to answer the CNIL's requests or sending inaccurate, incomplete or misleading information. A daily penalty payment may reach 5 % of average daily worldwide revenue or turnover.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
The Commission nationale de l'informatique et des libertés (CNIL), whose president and restricted committee exercise the powers of Articles 19, 20, 22 and 22-1 against providers of online platforms under Article 124-5.
What this law does
Article 124-5 makes the CNIL a competent authority under Article 49 of the Digital Services Act for providers of online platforms whose main establishment is in France or whose legal representative resides or is established in France. It ensures respect of Article 26(1)(d) of the Digital Services Act, on informing recipients about the advertising shown on a platform's online interfaces.
It also ensures respect of Article 26(3), which bars advertising based on profiling with the special categories of personal data listed in Article 6(I) of the Loi Informatique et Libertés. It ensures respect of Article 28(2), which bars presenting advertising based on profiling to minors. Article 20(II) lets the CNIL's president accept commitments proposed by online platform providers that are meant to ensure the service complies with Article 124-5.
Under Article 20(V) the CNIL's restricted committee may order a platform provider that breaches Article 124-5 to bring the service into compliance, within a time limit of not less than three days. The injunction may carry a daily penalty payment of up to 5 % of the provider's average daily worldwide revenue or turnover for the preceding financial year.
The restricted committee may also impose an administrative fine of up to 6 % of the provider's worldwide turnover for the preceding financial year. Where a provider fails to answer the CNIL's requests or sends inaccurate, incomplete or misleading information, the maximum fine falls to 1 % of worldwide turnover.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.