A French privacy watchdog accused the tech giants Google and Facebook of making it difficult for users to opt out of tracking their activity.
France’s online privacy regulator has ordered Google and Facebook to cough up some €210 million ($237 million) between them, fining the firms for their questionable use of data-tracking ‘cookies’ on their sites.
A report by The Hill (https://thehill.com/policy/technology/588551-google-facebook-hit-with-more-than-200m-in-fines-by-french-regulators) said:
An investigation found the sites “offer a button allowing the user to immediately accept cookies” but they do not provide an option to “easily refuse the deposit of these cookies,” the CNIL data privacy watchdog announced on Thursday.
CNIL said that it would fine Google 150 million euros and fine Facebook 60 million euros as a result of the investigation’s findings.
“Several clicks are required to refuse all cookies, against a single one to accept them,” the group said.
“The restricted committee considered that this process affects the freedom of consent: since, on the Internet, the user expects to be able to quickly consult a website, the fact that they cannot refuse the cookies as easily as they can accept them influences their choice in favor of consent,” it added.
Cookies, which are used to target users for ads and other purposes, are more strictly regulated in Europe than in the U.S. In Europe, websites must first ask before tracking a user’s activity, according to The Associated Press.
Facebook, now known as Meta, told the AP that it would review the decision and work alongside authorities.
“Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls,” the company said.
Google said it understands “our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision,” according to the wire service.
The Hill has reached out to Facebook and Google for comment.
The French National Commission on Informatics and Liberty (CNIL) announced the move in a statement on Thursday, saying Google will be made to pay €150 million and Facebook another €60 million within a period of three months, or else face additional fines of €100,000 per day.
The commission said the way the companies employ ‘cookies’ – or small amounts of data generated while users browse websites that can be used to track their activity – “affects the freedom of consent,” as Facebook and Google make it much easier for netizens to authorize that data-tracking than to decline it.
“When you accept cookies, it’s done in just one click,” said Karin Kiefer, who leads the commission’s data protection and sanctions team. “Rejecting cookies should be as easy as accepting them.”
The watchdog org added that those practices violated the French Data Protection Act, and ordered the companies to “provide Internet users located in France with a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent.”
Both Google and Facebook issued statements vowing to work with French authorities to sort the issue, though the latter firm insisted its “cookie consent controls provide people with greater control over their data,” disputing the consent issues raised by the CNIL. Google, too, argued that “people trust us to respect their right to privacy and keep them safe,” but nonetheless said it would pursue “further changes” to comply with the order.
The CNIL statement (Cookies: the CNIL fines GOOGLE a total of 150 million euros and FACEBOOK 60 million euros for non-compliance with French legislation, 06 January 2022, https://www.cnil.fr/en/cookies-cnil-fines-google-total-150-million-euros-and-facebook-60-million-euros-non-compliance) said:
Following investigations, the CNIL noted that the websites facebook.com, google.fr and youtube.com do not make refusing cookies as easy as to accept them. It thus fines FACEBOOK 60 million euros and GOOGLE 150 million euros and orders them to comply within three months.
The restricted committee, the body of the CNIL responsible for issuing sanctions, has noted, following investigations, that the websites facebook.com, google.fr and youtube.com offer a button allowing the user to immediately accept cookies. However, they do not provide an equivalent solution (button or other) enabling the Internet user to easily refuse the deposit of these cookies. Several clicks are required to refuse all cookies, against a single one to accept them.
The restricted committee considered that this process affects the freedom of consent: since, on the Internet, the user expects to be able to quickly consult a website, the fact that they cannot refuse the cookies as easily as they can accept them influences their choice in favor of consent. This constitutes an infringement of Article 82 of the French Data Protection Act.
As a result of this infringement, the CNIL’s restricted committee issued:
- a fine of 150 million euros against GOOGLE(90 million euros for GOOGLE LLC and 60 million euros for GOOGLE IRELAND LIMITED);
- a fine of 60 million euros against the company FACEBOOK IRELAND LIMITED.
In addition to the fines, the restricted committee ordered the companies to provide Internet users located in France with a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent, within three months. If they fail to do so, the companies will have to pay a penalty of 100,000 euros per day of delay.
These two decisions are part of the global compliance strategy initiated by the CNIL over the past two years with French and foreign actors publishing websites with a lot of visits and having practices contrary to the legislation on cookies.
Since March 31, 2021, when the deadline set for websites and mobile applications to comply with the new rules on cookies expired, the CNIL has adopted nearly 100 corrective measures (orders and sanctions) related to non-compliance with the legislation on cookies.