On Thursday, France’s data privacy watchdog CNIL announced a record fine of 150 million euros ($169 million) against Alphabet’s Google for making it difficult for internet users to refuse web trackers known as cookies.
According to the CNIL, Meta Platforms’ Facebook was also penalized 60 million euros for the same reason.
Cookie consent is a crucial pillar of the European Union’s data privacy regulation and a primary goal for the CNIL. Cookies are little snippets of data that help develop targeted digital ad campaigns.
“Accepting cookies is as simple as clicking a button,” said Karin Kiefer, the CNIL’s head of data protection and sanctions. “It should be as simple to refuse cookies as it is to accept them.”
The watchdog stated in a statement that it discovered that the websites facebook.com, google.fr, and youtube.com did not make it easy to refuse cookies, citing Google’s video-streaming platform as an example.
The two enterprises had three months to comply with the CNIL’s directives or face a penalty of 100,000 euros per day they were late.
Among them is Google’s and Facebook’s need to provide French internet users with simpler tools for refusing cookies in order to ensure their permission.
While Google and Facebook provided a virtual button to allow immediate acceptance of cookies, the CNIL stated that there was no counterpart to instantly deny them.
“People trust us to protect them and respect their right to privacy. In light of this ruling, we recognize our obligation to protect that trust and have committed to further adjustments and active collaboration with the CNIL, a Google representative said.
A request for comment from Facebook was not immediately returned.
The CNIL’s previous record fine, of 100 million euros, was levied against Google in 2020.
The CNIL discovered at the time that Google’s French websites did not get visitors’ prior authorization before installing advertising cookies on their computers and failed to offer clear information about how it intended to use them.
Since then, according to Kiefer, the difficulties have been fixed.
The CNIL strengthened consent rights over ad trackers in 2020, requiring websites operating in France to preserve a six-month log of internet users’ refusal to accept cookies.
It further stated that internet users should be able to easily reconsider any initial cookie agreement via a web link or an icon available on all website pages.
