CNIL fines Google LLC and Google Ireland Limited €100 million, and Amazon Europe Core €35 million, for their use of advertising cookies, contrary to French standards
Following several inspections in 2019 and 2020, the CNIL found numerous breaches with regard to cookies on the amazon.fr and google.fr websites. Both sites were depositing cookies without first obtaining the user's consent and without providing them with the necessary information. In the case of the Google site, the CNIL also highlighted the partial failure of the "opposition" mechanism.
As for the deposit of cookies without consent: The CNIL found that the two sites deposited numerous cookies for advertising purposes as soon as the user arrived on the home pages, without the user performing any other action. These cookies, which are not essential to the service, should not have been deposited without the prior consent of the users.
As for the lack of information: The CNIL noted that the Google site displayed a banner relating to confidentiality and that the Amazon site displayed a banner vaguely referring to the use of cookies, but only in the case where the user went directly to the site without clicking on an advertisement on another site. In both cases, there is a lack of full and clear information about the purposes of the cookies used.
As for the "opposition" mechanism put in place on the Google site: The site provided a mechanism that should have allowed the user to deactivate the personalization of the advertisements proposed when using Google's services. However, the CNIL found that in reality, one of the advertising cookies remained stored on the user's computer and continued to read information from the server to which it was attached. The partially defective mechanism was then considered to violate Article 82 of the French Data Protection Act.
As a reminder, the CNIL published new guidelines and a recommendation on the use of cookies and other trackers on 1 October 2020. It is then necessary to comply with the clarified rules, with an adaptation period not exceeding six months.
https://www.cnil.fr/fr/cookies-sanction-de-35-millions-deuros-lencontre-damazon-europe-core