The CNIL Fines Google and Amazon for Cookie Law Violations

• The French data protection office fined Amazon and Google a total of 135 million euros.
• Their violations include serving non-essential cookies without asking for the user’s consent.
• Google kept a cookie on the user’s browser even after the latter specifically opted-out of targeted advertising.

CNIL (Commission Nationale de l'Informatique et des Libertés), the French regulatory body for data privacy, has announced the fining of Google and Amazon for violations relevant to online advertising trackers commonly known as “cookies.” The sanctions include a 60 million euros fine on ‘Google LLC,’ another 40 million euros on ‘Google Ireland Ltd.,’ and a 35 million euros fine to ‘Amazon Europe Core.’ That’s a total of 135 million euros, which is about $163.2 million.

As the CNIL explains, they released guidelines on how to use cookies on October 1, 2020, and initially decided to give all players a maximum of six months to adapt their tracking systems. However, Amazon and Google have both failed to make adequate modifications thus far and almost completely ignored the dictations of the French “ePrivacy” directive.

The violations that have been confirmed in the two announcements are the following:

• Depositing of cookies without obtaining the prior consent of the user on ‘amazon.fr.’
• Depositing of cookies without obtaining the prior consent of the user on ‘google.fr.’
• Lack of information provided to the users of the website ‘amazon.fr.’
• Lack of information provided to the users of the website ‘google.fr.’
• Partial failure of the “opposition” mechanism (Google).

The placement of the cookies without consent constitutes violations of Article 82 of the French Data Protection Act. These are cookies that are not essential to the service provision, so they are optional trackers that should only be activated after the user specifically approves them. The violations that are relevant to the lack of information concern the exact same thing, which is the failure to inform the visitors about what cookies are loaded by default and what their purpose is.

As for the “opposition” mechanism, the violation lies in the fact that when a user chooses to deactivate the ad personalization on Google Search, a tracking cookie remains stored on their browser, continuing to access browsing data. This is again a violation of Article 82 of the French Data Protection Act.

For Amazon and Google, these fines cannot be considered as anything serious for their financial status. Still, they could become troublesome if more data protection authorities followed along the same path. However, the case highlights that even when strict data protection regulations are in place, enforcing them on advertising giants is very hard - and even large fines may not be enough to make a difference.