Rejecting Google Cookies Harder than Accepting Them
Cookies track and save information from every session, i.e., any period of time spent on a website. Under European personal data protection law, websites must take prior consent from users for using cookies. However, CNIL said that Google makes it easier for users to opt-in than to reject cookies. “When you accept cookies, it’s done in just one click,” said Karin Kiefer, the regulator’s head of data protection. “Rejecting cookies should be as easy as accepting them.” CNIL has also fined Facebook 60 million euros for the same violation. It was determined that the websites facebook.com, google.fr, and youtube.com do not “allow for refusal of cookies easily.”
Google and Facebook Given 3 Months to Comply with CNIL’s Order
The regulator has ordered Google and Facebook to give French language users “simpler tools for refusing cookies, in order to guarantee their consent.” CNIL also pointed out that both platforms provide a virtual button to immediately accept cookies, but not for refusal. The two global tech giants have three months to comply with the regulators’ orders — failing which, they will face an extra penalty of 100,000 euros per day of delay. In response, a Google spokesperson said, “People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision.” Facebook is yet to comment on CNIL’s decision.
Previous Sanctions by CNIL
The fine on Google is the largest ever levied by the CNIL. Its previous record fine was also against the tech giant. In 2020, it found that Google’s French websites did not take users’ prior consent before saving advertising cookies on computers. Google also did not provide clear information about how it intended to use the data. The fine amounted to 100 million euros. According to Kiefer, these issues have since been resolved. In the same year, the regulator stated that websites operating in the country “should keep a register of internet users’ refusal to accept cookies for at least six months.” Furthermore, it said that users should be able to go back and reconsider previous agreements on cookies. To achieve this, websites should provide a link or an icon that is visible on all of their pages.
