France’s data protection agency Cnil has inflicted fines of EUR 100 million and EUR 35 million on Google and Amazon respectively. Both companies have been found guilty of breaching data protection rules by placing advertising cookies on users’ computers without obtaining appropriate consent and with no adequate information.
The EUR 100 million fine, which combines EUR 60 million to be paid by Googlo LLC and EUR 40 million by Google Ireland, follows an online investigation carried out in March on google.fr. The agency said that the website was found to place cookies automatically without any action required by users. A banner displayed at the bottom of the page failed to provide online visitiors with any information on the placement of cookies, with several of them used for advertising purposes.
Additionally, the regulator concluded that the “opposition” mechanism set up by Google was partially defective. Even if a user opted to deactivate ad personalization on the Google search, using the available mechanism from the “Access now” button, one of the advertising cookies was still stored and kept reading information aimed at the server to which it was attached.
In addition to the fine, Google has also been told that it will face a daily penalty if it fails to comply with French data protection rules on cookies within three months, amounting to EUR 100,000 for each day of delay.
The threat of this additional financial penalty also applies to Amazon for similar violations recorded on the amazon.fr website, following a number of investigations carried out by the regulator between the end of 2019 and the first half of this year.
