It is the season of cookies (the edible kind) but not for Google! On 7th December the CNIL sanctioned the companies GOOGLE LLC and GOOGLE IRELAND LIMITED a total of 100 million Euros for having put advertising cookies on the computers of people who used the search engine google.fr. The company did this without the users’ prior consent or sufficient information about the process.
So, before we look at what google.fr did and why they were fined let’s remind ourselves about what cookies actually are. Cookies are tiny text files placed on your computer or mobile phone by the websites or search engines that you use. Now there are essential cookies that are necessary for the functioning of a search engine or website but like most things they can be put to another use and the most common use is for commercial purposes namely advertising. The law states that a search engine or website should display information about the cookies it uses then you have the choice whether to accept or not.
On the 16 March 2020 the CNIL did a test on the website google.fr and found that those who used this search engine were automatically having cookies transmitted to their website without any action on their part; i.e. without their consent. Many of these cookies were for advertising purposes. Article 82 of the Law “Informatiques et Liberties“ requires that users consent to receiving these non essential cookies.
So what exactly did google.fr do to warrant such a high fine? Well, when a user went on the page google.fr at the foot of the page there was a reminder concerning the rules of confidentiality and Two buttons, one said “Remind me later” the other “Consult now”. The reminder gave absolutely no information about the cookies that had already been placed on the user’s computer nor was this information forthcoming when the user pressed “Consult now”. CNIL felt that this meant that users living in France had not consented to the downloading of cookies and did not have the means to refuse. This meant that advertising cookies had been downloaded permanently on to their computer and continued to read information travelling to the server to which it was connected. This is in partial violation of article 82 Informatiques and Liberties.
So why was the fine so high? Well CNIL felt that the search engine Google Search affected around 50 million users. They also thought that there had been considerable financial advantages because of the advertising revenues generated by the data collected by these advertising cookies. It was noted that since September 2020 advertising cookies were no longer automatically downloaded when a user came to the page google.fr. However, CNIL thought that users based in France did not fully understand how their data was being used or that they could refuse the cookies.
In addition to these fines CNIL has said that google.fr must inform the persons concerned within 3 months or face an additional payment of 100,000 Euros a day.