Cookies: FACEBOOK IRELAND LIMITED fined 60 million euros
Failure to comply with the French Data Protection Act
The restricted committee, the CNIL body responsible for issuing sanctions, noted that making the refusal mechanism more complex actually discourages users from refusing cookies and encourages them to opt for the ease of the consent button for cookies in the first window. It considered that such a process affects the freedom of consent of Internet users.
The restricted committee also considered that the information given by the company is not clear since, in order to refuse the deposit of cookies, Internet users must click on a button entitled "Accept cookies", displayed in the second window. It considered that such a title necessarily generates confusion and that the user may have the feeling that it is not possible to refuse the deposit of cookies and that they have no way to manage it.
The restricted committee judged that the methods of collecting consent proposed to users, as well as the lack of clarity of information provided to them, constitute violations of Article 82 of the French Data Protection Act.
The restricted committee fined FACEBOOK IRELAND LIMITED 60 million euros and made it public.
It justified this amount by the scope of the processing, the number of data subjects concerned and the considerable profits the company makes from advertising revenues indirectly generated from the data collected by the cookies.
In addition to the administrative fine, the restricted committee also issued an injunction with periodic penalty payment requiring that the company provides Internet users located in France, within three months of the notification of the decision, with a means of refusing cookies that is as simple as the existing means of accepting them, in order to guarantee the freedom of their consent. Otherwise, the company may pay a penalty of 100,000 euros per day of delay.
Jurisdiction of the CNIL
Note: The company FACEBOOK IRELAND LIMITED, whose head office is in Ireland, presents itself as the data controller of the Facebook service in the European region. The company FACEBOOK FRANCE is the establishment in France of the Facebook group.