The CNIL Fines Google and Amazon for Cookie Law Violations

By Bill Toulas / December 10, 2020

CNIL (Commission Nationale de l'Informatique et des Libertés), the French regulatory body for data privacy, has announced the fining of Google and Amazon for violations relevant to online advertising trackers commonly known as “cookies.” The sanctions include a 60 million euros fine on ‘Google LLC,’ another 40 million euros on ‘Google Ireland Ltd.,’ and a 35 million euros fine to ‘Amazon Europe Core.’ That’s a total of 135 million euros, which is about $163.2 million.

As the CNIL explains, they released guidelines on how to use cookies on October 1, 2020, and initially decided to give all players a maximum of six months to adapt their tracking systems. However, Amazon and Google have both failed to make adequate modifications thus far and almost completely ignored the dictations of the French “ePrivacy” directive.

The violations that have been confirmed in the two announcements are the following:

The placement of the cookies without consent constitutes violations of Article 82 of the French Data Protection Act. These are cookies that are not essential to the service provision, so they are optional trackers that should only be activated after the user specifically approves them. The violations that are relevant to the lack of information concern the exact same thing, which is the failure to inform the visitors about what cookies are loaded by default and what their purpose is.

As for the “opposition” mechanism, the violation lies in the fact that when a user chooses to deactivate the ad personalization on Google Search, a tracking cookie remains stored on their browser, continuing to access browsing data. This is again a violation of Article 82 of the French Data Protection Act.

For Amazon and Google, these fines cannot be considered as anything serious for their financial status. Still, they could become troublesome if more data protection authorities followed along the same path. However, the case highlights that even when strict data protection regulations are in place, enforcing them on advertising giants is very hard - and even large fines may not be enough to make a difference.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: