A French regulator, the CNIL’s restricted committee, which is responsible for imposing sanctions, fined the company Amazon Europe Core and Google 155 million Euro for having placed advertising cookies on users’ computers, from the page amazon.fr and Google.fr, without obtaining prior consent and without providing adequate information.
Two breaches of Article 82
From 12 December 2019 to 19 May 2020, the CNIL conducted several investigations, including online investigations, regarding the website amazon.fr. On 16 March 2020, the CNIL conducted an online investigation on the website google.fr.
The CNIL’s restricted committee noticed two breaches of Article 82 of the French Data Protection Act. CIL explained th deposit of cookies without obtaining the prior consent of the user, saying,
“The restricted committee noted that when a user visited one of the pages of the website amazon.fr, a large number of cookies used for advertising purposes was automatically placed on his or her computer, before any action required on his or her part.”
The restricted committee also noted that, in the case of a user visiting the website amazon.fr, the information provided was neither clear nor complete.
Lack of information
On the Google side, when a user visited the page google.fr, the banner did not provide the user with any information regarding cookies that had however already been placed on his or her computer when arriving on the site. The restricted committee imposed a financial penalty of 60 million euros on GOOGLE LLC and another one of 40 million euros on GOOGLE IRELAND LIMITED and decided to make them public.
Google and Amazon disagreed with the CNIL’s decision. “We stand by our record of providing upfront information and clear controls, strong internal data governance, secure infrastructure, and above all, helpful products. Today’s decision under French ePrivacy laws overlooks these efforts and doesn’t account for the fact that French rules and regulatory guidance are uncertain and constantly evolving,” Google was quoted by Reuters as saying in a statement.
Amazon talked about the decision, saying,
“We continuously update our privacy practices to ensure that we meet the evolving needs and expectations of customers and regulators and fully comply with all applicable laws in every country in which we operate.”