France’s CNIL’s data privacy watchdog imposed fines of 135 million euros on American tech titans Google and Amazon for placing advertising cookies on users’ computers without their consent.
The € 100 million fine against Google is the biggest sanction ever imposed by the regulator, justified by the fact that 90 percent of French Internet users use the company’s search engine.
The CNIL said that the fines were “for having placed advertising cookies on users’ computers … without obtaining prior consent and without providing adequate information.”
A cookie is a small piece of data stored on a user’s computer browser that allows websites to identify users and remember their previous activity. They are important to deliver targeted advertising and to improve the user experience on websites.
The CNIL said that when a user visited the google.fr website, various cookies used for advertising purposes were automatically placed on their computer, with no action required from the user.
He said that something similar happened when visiting a page on the amazon.fr website.
The regulator said that “no matter which route users used to visit the website, they were not sufficiently informed or were never informed of the fact that cookies were placed on their computer.”
CNIL said that the type of cookie that is used “can only be placed after the user has expressed consent” and therefore violates the regulations on receiving prior consent.
It blamed Google for providing insufficient privacy information for users, as it did not inform them about the cookies that had been placed and that the procedure to block them was still operational.
CNIL said that after redesigns implemented in September 2020, the websites of both companies stopped placing cookies on computers without consent.
However, he criticized both for not yet providing clear or complete information on the use of cookies and for the possibility of rejecting them, ordering both to make changes within three months or face additional fines.
– “Uncertain” French rules –
CNIL imposed fines of € 60 million on Google LLC and € 40 million on Google Ireland Limited.
The fine of 35 million euros (42 million dollars) falls on the Amazon Europe Core subsidiary.
When contacted, Google defended its “history of providing up-front information and clear controls” to users.
A Google representative also complained “that French regulatory standards and guidelines are uncertain and constantly evolving” and overlooked its efforts to comply.
Amazon also expressed its disagreement with the fine in a statement sent to AFP.
“We continually update our personal data protection practices to ensure that we meet the evolving needs and expectations of customers and regulators,” he said in a document written in French.
The sanctions were based on French regulations before the European Data Protection Regulation (GDPR) came into effect in 2018.
The GDPR toughened fines for violations that can increase up to 4 percent of a company’s worldwide revenue.
CNIL has said that it will begin in April 2021 to fine companies that do not comply with the GDPR requirement of having the option to accept or reject all cookies.
[AFP]
