Are cookies used to combat fraud (e.g. in e-commerce services or online banking) exempt from the obligation to obtain consent?

ANSWER

Cookies used for the purpose of combating financial fraud are in principle not subject to the exemption provided for in Article 173(3) of the Telecommunications Act.

At the same time, it is worth noting at this point the position of the French supervisory authority (CNIL), which considers that the exemption may apply to them in certain specific cases. This concerns in particular those mechanisms that are intended to ensure the security of user authentication (e.g. by limiting automated or unexpected access attempts). In such cases, the tracking mechanisms may be considered necessary for the provision of a service at the request of the user or subscriber.