Amazon And Google Punished By The CNIL For Their Use Of Cookies

Amazon is fined 35 million euros and Google is ordered to pay 100 million euros for violating legislation on cookies.

The restricted formation, the body of the CNIL responsible for pronouncing the sanctions, notes, following checks, that when an Internet user goes to the google.fr and amazon.fr websites, advertising cookies are placed on his computer without that he has given his prior consent. It also notes that the information banners displayed when consulting these sites do not contain sufficiently clear information for the Internet user to know what these cookies are used for and how he can refuse them.

According to the CNIL, these two points constitute breaches of article 82 of the Data Protection Act: the law provides that advertising cookies can only be placed if the Internet user gives his prior consent, after having been properly informed of what these cookies are used for.

As a result of these breaches, the restricted form of the Cnil pronounces a sanction of 60 million euros against the company Google LLC and a sanction of 40 million euros against the company Google Ireland Limited, as well as a sanction of 35 million euros against the company Amazon Europe Core.

In addition to the fines, the CNIL asks companies to modify their information banner within three months of notification of the decision. Otherwise, the fine will amount to 100,000 euros per day of delay.

Note, these obligations predate the new European GDPR regulation (entered into force on May 25, 2018). For new obligations under RPGD, the CNIL issued on 1 st October 2020, new guidelines and a recommendation on the use of cookies and other plotters. She asked actors to comply with the new rules, believing that the adaptation period should not exceed six months. On that occasion, it nevertheless specified that it would continue in particular to fully monitor compliance with the other obligations which have not been the subject of any modification.