Getty Images | Sean Gladwell
French regulators today ordered Google and Facebook to make rejecting cookies as simple as accepting them and fined the companies a total of €210 million for failing to comply with France’s Data Protection Act.
CNIL (Commission Nationale de l’Informatique et des Libertés) stated that “facebook.com, google.fr and youtube.com provide a button by which the user can accept cookies immediately” but “a similar solution (button or other ) enables the Internet user to easily decline the deposit of these cookies. Multiple clicks are required to decline all cookies, against one to accept them.”
CNIL said the “process of making cookies harder to refuse than to accept” affects the freedom of consent of Internet users and is a violation of Article 82 of the French Data Protection Act. The agency also announced fines of €150 million for Google and €60 million for Facebook, and said it sought “a means of refusing companies based in France to accept cookies as simple as the existing means of accepting cookies.” Ordered to provide, so as to guarantee. Their freedom of consent, within three months. If they fail to do so, the companies will have to pay a fine of 100,000 euros per day for delays.”
CNIL said that it has received several complaints from users regarding both the companies. In its announcement of Google’s fines, CNIL said it determined that “further complicating the refusal mechanism actually discourages users from refusing cookies and gives them access to the ‘I accept’ button.” encourages the choice of With Facebook, “In order to refuse the submission of cookies, Internet users must click on a button labeled ‘Accept Cookies’ displayed in a second window … Such a title inevitably leads to confusion and … may feel that it is not possible to refuse the submission of cookies and that they have no way of managing it.”
Penalty based on advertising revenue
The agency said it calculated each fine “based on the number of related data subjects and the substantial profits the company would have from advertising revenue generated indirectly from the data collected by cookies.” But the fine will not make much dent in the company’s revenue. Google owner Alphabet reported $65.1 billion in revenue and $18.9 billion in net income in its most recent quarter, while Facebook reported $29 billion in revenue and $9.2 billion in net income.
The new cookie rules for websites and mobile applications came into effect on March 31, 2021. Since that date, “CNIL has adopted approximately 100 corrective measures (orders and sanctions) relating to non-compliance with the Law on Cookies,” the agency said.
Google and Facebook unclear on planned changes
When contacted by Ars, neither Google nor Facebook has explained how they will change their cookie policies to comply with this decision. A Google spokesperson said, “People trust us to respect and protect our right to privacy. We recognize our responsibility to protect that trust and make this decision under the e-Privacy Directive. Committed to further transformation and proactive work with CNIL in light of this.”
Facebook owner Meta told Ars, “We are reviewing the authorization decision and are committed to working with relevant authorities. Our cookie consent controls give people more control over their data, including Facebook and Instagram.” But we include a new settings menu where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls.”
