On 7 December 2020, the CNIL’s restricted committee, which is responsible for imposing sanctions, fined the companies GOOGLE LLC and GOOGLE IRELAND LIMITED a total of 100 million euros for having placed advertising cookies on the computers of users of the search engine google.fr, without obtaining prior consent and without providing adequate information.
The CNIL’s restricted committee, which is responsible for imposing sanctions, noticed three breaches of Article 82 of the French Data Protection Act:
Deposit of cookies without obtaining the prior consent of the user
When a user visited the website google.fr, several cookies used for advertising purposes were automatically placed on his or her computer, without any action required on his or her part.
Since this type of cookies can only be placed after the user has expressed his or her consent, the restricted committee considered that the companies had not complied with the requirement provided for in Article 82 of the French Data Protection Act regarding the collection of prior consent before placing cookies that are not essential to the service.
Lack of information provided to the users of the search engine google.fr
When a user visited the page google.fr, an information banner displayed at the bottom of the page, with the following note “Privacy reminder from Google”, in front of which were two buttons: “Remind me later” and “Access now”.
This banner did not provide the user with any information regarding cookies that had however already been placed on his or her computer when arriving on the site. The information was also not provided when he or she clicked on the button “Access now”.
Therefore, the restricted committee considered that the information provided by the companies did not enable the users living in France either to be previously and clearly informed regarding the deposit of cookies on their computer or, therefore, to be informed of the purposes of these cookies and the available means enabling to refuse them.
Partial failure of the « opposition » mechanism
When a user deactivated the ad personalization on the Google search by using the available mechanism from the button “Access now”, one of the advertising cookies was still stored on his or her computer and kept reading information aimed at the server to which it is attached.
Therefore, the restricted committee considered that the “opposition” mechanism set up by the companies was partially defective, breaching Article 82 of the French Data Protection Act.
source: Commission nationale de l’informatique et des libertés
