France’s data protection agency, the CNIL, has fined Google and Amazon for dropping tracking cookies without consent. Google has been hit with a total of €100 million for dropping cookies on Google.fr and Amazon €35 million for doing the same on the Amazon.fr domain.
Breaches made by Google
In Google case, CNIL noticed three breaches of Article 82 of the French Data Protection Act:
1. deposit of cookies without obtaining the prior consent of the user;
2. lack of information provided to the users of the search engine google.fr;
3. partial failure of the “opposition” mechanism. It means that when a user deactivated the ad personalization on the Google search by using the available mechanism from the button “Access now”, one of the advertising cookies was still stored on his or her computer and kept reading information aimed at the server to which it is attached.
Breaches made by Amazon
In Amazon case, CNIL noticed two breached of Article 82 of the French Data Protection Act:
1. deposit of cookies without obtaining the prior consent of the user;
2. lack of information provided to the users of the website amazon.fr.
CNIL actions as its action plan on targeted advertisement
As part of its action plan on targeted advertisement and in order to take into account the entry into force of the GDPR, the CNIL released its amending guidelines and a recommendation regarding the use of cookies and other tracking devices on 1st October 2020. The CNIL asked the players to comply with the rules, thus clarified, considering that the period of adaptation should not exceed six months. On this occasion, the CNIL however added that it will keep fully controlling compliance with the other obligations that have not been modified and, if necessary, adopting corrective measures to protect the privacy of internet users. As it was noticed in the notifications of CNIL, the CNIL punishes today the breach, by the companies, of obligations that existed before the GDPR and were therefore not concerned by the new guidelines and the recommendation of 1st October 2020.
What can we learn from the case?
The decision by CNIL isn’t surprising, because we have signal earlier that cookies and consent on their use is something about what data controllers shall care. The Court of Justice of the European Union in the case of Planet49 GmbH, ruled on that the consent is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent. 15 May 2020 European Data Protection Board published its Guidelines 05/2020, where one of the highlights were cookies’ wall – in order to ensure that the data subject’s consent to the use of cookies is freely given, such consent must not be a condition for access to services, functions or access to information already provided on the user’s terminal, known as the “cookie walls”.
Recommendations of ECOVIS ProventusLaw
1. to make the analysis of the cookies used in your website;
2. prepare the cookies policy. It shall cover the information about the used cookies, how to manage cookies, how to delete them and etc.;
3. most important to ensure your technical solution so that your website visitors are able to give their consent to use the cookies. There shall be no doubts that consent is freely given, specific, informed and unambiguous indication of the data subject’s wishes or clear affirmative action. At the moment the data controllers may use only the strictly necessary cookies without the freely given consent by data subject;
4. the data subject shall be informed about the used cookies.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
More information could be found here and here.
Prepared by ECOVIS ProventusLaw data protection experts Loreta Andziulytė and Milda Šlekytė
Newsletter Subscription
Get in touch