CNIL Fines Google LLC and Google Ireland Limited for Placing Cookies on Google.fr

On December 7, 2020, the CNIL fined Google LLC and Google Ireland Limited with a total fine of 100 million euros, in particular for deploying advertising cookies on the google.fr visitors’ devices without prior consent and for not meeting transparency requirements.

Deploying cookies without prior consent

The CNIL has found that google.fr has been deploying advertising cookies on users’ devices without their prior consent and as such cookies are not considered essential cookies, prior consent should have been requested.

Lack of transparency

The search engine page has a banner at the footer of the page informing individuals about Google’s privacy policy with buttons “Remind me later” and “View now”, none of which allowed individuals to familiarize themselves with the cookies used.

The opt-out mechanism wasn’t disabling all advertising cookies

When a user deactivates the personalization of ads on Google, using the mechanism available through “Consult now” button, one of the advertising cookies remained stored on their computer and continued to be used.

The CNIL fined Google LLC with a fine of 60 million euros and Google Ireland Limited with a fine of 40 million euros. The violation affected fifty million users. It was pointed out that these companies have made high profits from the use of advertising cookies. Since September 2020, the advertising cookies have not been deployed automatically. Nonetheless, the new banner does not allow users to understand the purposes for which cookies are used and refuse these cookies.

An injuction has been issued to rectify the remaining issues. If the companies do not abide by it, they will be exposed to the payment of a fine of 100,000 euros per day of delay.

The CNIL considers itself competent to decide in this matter as the use of cookies falls under ePrivacy directive and because the cookies were used in the course of the activities of Google France which is considered to be an establishment of Google LLC and Google Ireland Limited in France.

It also considers Google LLC and Google Ireland Limited jointly responsible since they both determine the purposes and means related to the use of cookies.

Note: Google LLC, established in California, developed the Google search engine. Google Ireland Limited, headquartered in Ireland, presents itself as the European headquarters of the Google group. Google France is an establishment of GOOGLE LLC in France.

The information in this article is available in the CNIL’s press release.

Photo by RODNAE Productions from Pexels.