The CNIL (Commission nationale de l’informatique et des libertés) said that following investigations on websites facebook.com, google.fr, and youtube.com, they found that these sites offer a button allowing the user to immediately accept cookies. However, they do not provide an equivalent solution (button or other) that allows the Internet user to easily refuse the deposit of these cookies. In fact, the user is required to click several times to refuse all cookies, as opposed to a single click to accept them. The restricted committee, the CNIL body responsible for issuing sanctions, noted that making the refusal mechanism more complex actually discourages users from refusing cookies and encourages them to opt for the ease of the consent button for cookies in the first window. The regulator also considered that the information given by the company is not clear since, in order to refuse the deposit of cookies, Internet users must click on a button entitled “Accept cookies”, displayed in the second window. It considered that such a title necessarily generates confusion and that the user may have the feeling that it is not possible to refuse the deposit of cookies and that they have no way to manage it. The restricted committee judged that the methods of collecting consent proposed to users affects the freedom of consent of Internet users since the user “cannot refuse the cookies as easily as they can accept them,”, as well as the lack of clarity of information provided to them, constitute violations of Article 82 of the French Data Protection Act. As a result of this infringement, the CNIL’s restricted committee issued:
a fine of 150 million euros against GOOGLE (90 million euros for GOOGLE LLC and 60 million euros for GOOGLE IRELAND LIMITED); a fine of 60 million euros against the company FACEBOOK IRELAND LIMITED.
Besides the fines, the restricted committee has ordered the companies to provide Internet users located in France with a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent, within three months. If they fail to do so, the companies will have to pay a penalty of 100,000 euros per day of delay. These two decisions are part of the global compliance strategy initiated by the CNIL over the past two years with French and foreign actors publishing websites with a lot of visits and having practices contrary to the legislation on cookies. Google said, “People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision.” Facebook’s parent company Meta said it’s reviewing the decision and is committed to working with relevant authorities. “Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls,” the company said.
