Both Google and Facebook have been fined massive sums by the French data watchdog organization the CNIL over failing to uphold policies on cookies. Google was fined 150 million Euros ($170 million) and Facebook 60 million Euros ($69 million) following investigations, that the websites facebook.com, google.fr and youtube.com offer a button allowing the user to immediately accept cookies. However, they do not provide an equivalent solution (button or other) enabling the Internet user to easily refuse the deposit of these cookies.
In addition to the fines, the restricted committee ordered the companies to provide Internet users located in France with a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent, within three months. If they fail to do so, the companies will have to pay a penalty of 100,000 euros per day of delay.
In response, a Google spokesperson said, “People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision.”
Facebook’s parent company Meta said, “We are reviewing the authority’s decision and remain committed to working with relevant authorities. Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls.”
by EURACTIV, Google said it was “committed to implementing further changes, as well as actively working with the CNIL in response to its decision, in the framework of the ePrivacy Directive.”
Facebook, for its part, explained that it was “reviewing” the decision. “Our cookie consent controls provide people with greater control over their data […], and we continue to develop and improve these controls,” a spokesperson for Meta, the social media’s parent company, has said.
The CNIL responds to requests from individuals and professionals, and carries out actions of communication with the general public and professionals, whether through its networks, the press, and its website, its presence on social networks or by providing educational tools. It can impose on a data controller to regularize its processing (formal notice) or impose sanctions (fine, etc.).
The restricted committee, the CNIL body responsible for issuing sanctions, noted that making the refusal mechanism more complex actually discourages users from refusing cookies and encourages them to opt for the ease of the consent button for cookies in the first window. It considered that such a process affects the freedom of consent of Internet users.