The amount of the fine imposed on Google is an all-category record for the sanctions imposed by the Commission Informatique et Libertés (Cnil), ahead of a previous fine of 100 million euros to Google in December 2020, already about cookies.
100,000 euros per day of delay
The two platforms have three months to comply, failing which “the companies will each have to pay a penalty of 100,000 euros per day of delay”, she added.
Cookies are small computer files installed by websites on the terminals of their visitors, for technical purposes or targeted advertising.
In particular, they allow advertising agencies to trace the user’s navigation, in order to be able to send him personalized advertising related to his centers of interest. They are regularly denounced for the invasions of privacy they can cause.
In a reaction sent to AFP, Google announced a change in its practices, following the decision of the Cnil. “In compliance with the expectations of Internet users, (…) we are committed to implementing new changes, as well as to working actively with the Cnil in response to its decision, within the framework of the directive (European editor’s note) ePrivacy”, assured the American giant.
Meta, Facebook’s parent company, said for its part that it was “assessing the decision” of the Cnil, and that it would “continue to work with the regulatory authorities” on these subjects. “We continue to develop and improve the control tools” of Internet users on cookies, continued the group.
90 formal notices sent
Since the entry into force of the European regulation on personal data (RFPD) in 2018, websites are required to comply with stricter rules to obtain the consent of Internet users before depositing their cookies. The Cnil had given until April 2021 to the publishers of the sites to adapt to this hardening and warned that it would begin to sanction after this period.
In July, Le Figaro had been the first to bear the brunt of this increased rigor, being fined 50,000 euros for cookies deposited by partners of the newspaper, “without action” on the part of the Internet user or “despite his refusal”.
The Cnil recently indicated that it had sent around 90 formal notices to website publishers since the end of its tolerance period.
“Accept cookies” to refuse trackers on Facebook
In the case of the sanctions imposed on Google and Facebook, the CNIL calls into question the contrast between the ease with which Internet users accept cookies and the difficulty in refusing them.
“The facebook.com, google.fr and youtube.com websites offer a button to immediately accept cookies,” explained the CNIL. On the other hand, “several clicks are necessary to refuse all cookies”, she denounced. This process “infringes the freedom of consent”, she stressed.
To add to the confusion, the button added by Facebook to refuse tracers is even called “Accept cookies”, she noted.
In general, the Cnil recommends that on the consent collection banners, the “Refuse all” button be as easy to access as “Accept all”.
In 2020, the Cnil had imposed penalties of 100 and 35 million euros respectively on Google and Amazon on cookies, based on principles prior to the European regulation on personal data. In particular, it considered that the information given to Internet users by the two platforms on their cookies was not “clear enough”.
See also on The HuffPost: Donald Trump sues Facebook, Twitter, Google and their bosses