France’s data privacy watchdog CNIL said on Thursday it had fined Alphabet’s Google a record 150 million euros ($169 million) for making it difficult for internet users to refuse online trackers known as cookies.
Meta Platforms’ Facebook was also fined 60 million euros for the same reason, the CNIL said.
Internet users’ prior consent for the use of cookies — tiny snippets of data that help build targeted digital ad campaigns — is a key pillar of the European Union’s data privacy regulation and a top priority for the CNIL.
“When you accept cookies, it’s done in just one click,” said Karin Kiefer, CNIL’s head for data protection and sanctions. “Rejecting cookies should be as easy as accepting them”.
In its statement, the watchdog said it had found that the facebook.com, google.fr and youtube.com websites didn’t allow the refusal of cookies easily, citing Google’s video-streaming platform.
The CNIL said the two companies had three months to comply with its orders or face an extra penalty payment of 100,000 euros per day of delay.
These include the obligation for Google and Facebook to provide French internet users simpler tools for refusing cookies, in order to guarantee their consent.
The CNIL said that while Google and Facebook provided a virtual button to allow the immediate acceptance of cookies, there was no equivalent to refuse them as easily.
“People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision,” a Google spokesperson said.
Facebook did not immediately respond to a request for comment.
CNIL’s previous record fine in 2020 also targeted Google and amounted to 100 million euros.
At the time, the CNIL found that Google’s French websites didn’t seek the prior consent of visitors before advertising cookies were saved on computers and failed to provide clear information about how it intended to make use of them.
Kiefer said the issues have been resolved since then.
In 2020, the CNIL strengthened consent rights over ad trackers, saying websites operating in France should keep a register of internet users’ refusal to accept cookies for at least six months.
It also said internet users should be able to easily reconsider any initial agreement concerning cookies via a web link or an icon that should be visible on all the website pages.
