France fines Google €150m over cookie failures

Commission Nationale de l’Informatique et des Libertés (CNIL) found that google.fr and youtube.com did not make refusing cookies as easy as accepting them as stipulated in the French Data Protection Act.

Facebook was also fined €60m for similar breaches and both firms have been given three months to comply with the rules. If they fail to do so, the companies will have to pay a penalty of €100,000 per day of delay.

Following an investigation, CNIL found that while they offer a button allowing the user to immediately accept cookies, they do not provide an equivalent solution enabling the user to easily refuse them. Several clicks are required to refuse all cookies, against a single one to accept them which influences users in favour of consent.

A deadline was set for the end of March last year for websites and mobile applications to comply with the new rules on cookies. The CNIL said it had taken nearly 100 similar measures related to non-compliance with the legislation on cookies since the rules were introduced.

“People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision,” a Google spokesperson said.

Google has faced repeated fines from the EU in recent years over breaches to anti-trust rules.

In March 2019, the search giant was fined €1.49bn for blocking rival online search advertisers. It was the third anti-trust enforcement measure taken by Europe in just two years.

Following an intervention from the UK’s Competition and Markets Authority (CMA) last year, Google laid out a set of commitments regarding its ‘Privacy Sandbox’ plans.

The CMA said its sandbox plans risked squeezing competition out of online advertising by removing third-party cookies and other functionalities from its updated Chrome browser.