France fines Google, Facebook for making cookies difficult to refuse

France's data privacy watchdog has fined Google a record 150 million euros and Facebook 60 million euros for making it difficult for French internet users to opt out of online trackers, known as cookies.

The National Commission for Information Technology and Freedom, or CNIL, said in a statement that it had found that Facebook, Google's French search site and its video platform Youtube force users to select many options to refuse cookies.

"Several clicks are required to refuse all cookies, against a single one to accept them," it said, concluding that this practice violated users' "freedom of consent".

The cookies' small bits of data allow the companies to personalise advertising, and user consent for that data to be collected is a key pillar of the European Union's GDPR data privacy regulation that was passed in 2018.

The legislation requires websites to ask for direct consent before installing cookies on users' computers.

In 2020, the CNIL strengthened consent rules, requiring websites operating in France to record users' cookie refusals for at least six months.

Google and Facebook have three months to comply with CNIL's orders to simplify the process to refuse cookies, or it will face extra penalties of 100,000 euros a day.

The CNIL said it calculated the fines based on the number of users and the profits they generate from data collected by their cookies.

Google said it would change options, following the decision.

Its 150 million euro fine is a record for the CNIL, which fined the company 100 million euros in 2020 for not informing users that cookies were saved on their computers, and for failing to provide clear information about how it intended to use the data.

In July 2021 Google was fined 500 million euros by France's competition authority for failing to properly compensate media companies for using their content in its search results.

(with wires)