On 6 January 2022, the French DPA (CNIL) announced imposing fines amounting to EUR 210M against Google (EUR 150M) and Facebook (EUR 60M) for inadequate cookies refusal options on their platforms. The two sanctioning decisions were issued on 31 December 2021, and until recently, were available only in French.
The two investigations were launched following a series of complaints concerning the methods available for refusing cookies on Google (including YouTube) and Facebook websites.
Further, the CNIL found that for accepting cookies in both cases, the user would only have to perform one action, whilst there are several actions necessary for the refusal of cookies. The CNIL considers that such a mechanism may encourage users to accept cookies rather than to refuse them, thus breaching the obligation to obtain the users’ freely given consent prior to installing any cookies on their terminal as per Article 5 (3) of the ePrivacy Directive.
In addition to the administrative fines, in order to ensure the freedom of consent in both cases, the CNIL also ordered the companies to provide users located in France with a means of refusing cookies that is as simple as the existing means of accepting them. In case the companies fail to do so within three months of the notification of the decision, they may pay a penalty of EUR 100,000 euros per day of delay.
In particular, since Google’s request to refer a question to the CJEU for a preliminary ruling was dismissed as incompatible with this administrative procedure, it’s worth monitoring whether Google will appeal this decision, and if so, whether the proposed question to the CJEU for a preliminary ruling will actually be referred.
With regard to Facebook, the press release is available here, and the decision here (both in English).
With regard to Google, the press release is available here, and the decision here (both in English).
