Cookies: GOOGLE fined 150 million euros

Failure to comply with the French Data Protection Act

The CNIL has received many complaints about the way cookies can be refused on the websites google.fr and youtube.com. In June 2021, the CNIL carried out an online investigation on these websites and found that, while they offer a button allowing immediate acceptance of cookies, the sites do not implement an equivalent solution (button or other) enabling the user to refuse the deposit of cookies equally easily. Several clicks are required to refuse all cookies, against a single one to accept them.

The restricted committee, the CNIL body in charge of issuing sanctions, judged that making the refusal mechanism more complex actually discourages users from refusing cookies and encourages them to opt for the ease of the "I accept" button.

The restricted committee considered that this process affects the freedom of consent of Internet users and constitutes an infringement of Article 82 of the French Data Protection Act, since it is not as easy to refuse cookies as to accept them.

The sanctions

The CNIL's restricted committee fined GOOGLE LLC 90 million euros and GOOGLE IRELAND LIMITED 60 million euros, both of which were made public.

It justified these amounts in particular by the number of people affected and the considerable profits that the companies make from advertising revenues indirectly generated from the data collected by cookies.

The restricted committee also noted that the CNIL services had already, in February 2021, drawn the attention of the GOOGLE companies to this infringement. It also recalled that the CNIL had communicated on numerous occasions that it should be as easy to refuse cookies as to accept them.

In addition to the administrative fines, the restricted committee also issued an injunction with periodic penalty payments requiring that the companies provide Internet users located in France, within three months of the notification of the decision, with a means of refusing cookies that is as simple as the existing means of accepting them, in order to guarantee their freedom of consent. Otherwise, the companies may pay a penalty of 100,000 euros per day of delay.

Jurisdiction of the CNIL

The CNIL is materially competent to verify and sanction operations related to cookies deposited by companies on the terminals of Internet users located in France. The cooperation mechanism provided for by the GDPR (the "one-stop-shop" procedure) is not intended to apply in these procedures insofar as operations related to the use of cookies fall within the scope of the " ePrivacy " directive, transposed in Article 82 of the French Data Protection Act. 

The restricted committee considered that the CNIL is also territorially competent pursuant to Article 3 of the French Data Protection Act because the use of cookies is carried out within the "framework of the activities" of GOOGLE FRANCE, which constitutes the "establishment" of GOOGLE LLC and GOOGLE IRELAND LIMITED on French territory.

It also considered that they are jointly responsible since they both determine the purposes and means of using cookies.

Note: GOOGLE LLC, based in California, develops the search engine Google Search and YouTube. GOOGLE IRELAND LIMITED, with its head office located in Ireland, presents itself as the European head office of the Google group. The company GOOGLE FRANCE is the establishment in France of the company GOOGLE LLC.