France fines Google a record $170 million for making it too difficult to opt-out of cookies.
The companies were fined a total of 210 million euros, or more than $237 million after an independent oversight authority investigated how users were able to opt-out of online tracking.
In its investigation, the Commission Nationale de l'Informatique et des Libertés (CNIL) found that users were only given a button to accept cookies but not one to deny them.
The move marks the latest blow against the tech giant in Europe, which has been repeatedly fined for breaches of EU competition law and faces investigations in different jurisdictions throughout the continent.
At issue: The CNIL said that Facebook, Google, and Google-owned YouTube “offer a button allowing the user to immediately accept cookies.” But “several clicks” are required to refuse all usage tracking cookies – vs. a single one to accept them.
The CNIL also ordered both Facebook and Google to change how they present cookie options to users in France.
The two companies were given three months to give local users the option to refuse cookie trackers “in order to guarantee their freedom of consent.” Failure to comply will result in daily fines of 100,000 euros – or $113,000.
“We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision under the eprivacy Directive.”
Facebook did not immediately respond to requests for comment.
A spokesperson for Facebook’s parent company Meta told TechCrunch: “We are reviewing the authority’s decision and remain committed to working with relevant authorities.”
In December 2020, the French watchdog fined Google $113 million for dropping tracking cookies without consent. Amazon was also hit with a $40 million penalty.
In a second statement, CNIL revealed it had also fined Facebook's holding company Meta €60 million (or around $68 million) for the same offense.
Failure to do so would compel the EU to act unilaterally and impose its own penalties on companies, Jourová warned. “I want to see full compliance, not legal tricks. It’s time not to hide behind small print, but tackle the challenges head-on.”
A Meta spokesperson told Politico the company was "reviewing the authority's decision," adding: "Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls."
In the US, federal regulators have been lax in enforcing privacy regulations on Big Tech, so that has forced states like Virginia and California to enact their own consumer protection laws.
Google also released a statement on the fines, saying that they "understand [their] responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision."
The French penalty underscores a broader shift in the digital ad industry as Google and Facebook, which dominate the market, and regulators in Europe and the U.S. work on phasing out more egregious data collection practices.
Google has announced plans to phase out so-called third-party cookies used by advertisers from its Chrome browsers, though it will still be able to track users of its own services.