Google and Facebook are facing major fines in France for not making it easy enough for French users to reject technology that tracks cookies.
According to documents obtained by Politico, French tech regulator Commission Nationale de I’informatique et Des Libertés (CNIL) is planning to fine Google 150 million euros and Facebook 60 million euros for violating French data privacy rules.
The watchdog noted that these sites offer a button allowing users to immediately accept cookies, but there is no equivalent button for rejecting and several clicks are needed to refuse all cookies.
It said that this “infringes the freedom of consent” as it “skews” the choice of users in favour of accepting cookies with a quicker process.
“Making the refusal mechanism more complex actually discourages users from refusing cookies and encourages them to opt for the ease of the consent button for cookies in the first window,” the watchdog stated in relation to the Facebook fine.
CNIL says in the document that both companies will be fined another 100,000 euros per day if they do not resolve the issues within three months of the decision being issued. Politico noted that this applies to google.fr, youtube.fr and all of Facebook’s platforms in France.
Under EU law, if consent is the legal basis being claimed for processing people’s data there are strict standards that must be adhered to — consent must be informed, specific, and freely given in order for it to be obtained legally.
“We are reviewing the authority’s decision and remain committed to working with relevant authorities,” a Meta spokesperson said. “Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls.”
“People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision under the ePrivacy Directive,” a Google spokesperson said in a statement.
