Google Ireland Ltd – €100,000,000 Fine (France, 2020)
Google was fined a massive amount for not following cookie rules, which require clear consent before placing cookies on users' devices. This ruling is significant because it reinforces the need for companies to be transparent about their data practices. Website operators should review their cookie policies to ensure compliance.
What happened
Google placed cookies on users' devices without obtaining proper consent.
Who was affected
Users of Google services in France who were affected by the cookie violations.
What the authority found
The French data protection authority found that Google violated cookie consent rules under GDPR and ePrivacy regulations.
Why this matters
This ruling serves as a wake-up call for all companies using cookies to ensure they have valid consent from users. It shows that regulators are serious about enforcing cookie laws.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Entities Involved
Google LLC is a company headquartered in USA, California. Since its creation in 1998, it has developed numerous services for individuals and businesses, such as the Google Search engine, the Gmail email box, the Google Maps mapping service, and the YouTube video platform. It has more than 70 offices in some 50 countries and employed more than 110,000 people worldwide in 2019. Since August 2015, it has been a wholly owned subsidiary of Alphabet Inc, the parent company of the Google group. Google Ireland Ltd, based in Dublin (Ireland), is the headquarters of the Google Group for its activities in the European Economic Area and Switzerland. Google France SARL is the French branch of the Google Group. On 16 March 2020, the French DPA (CNIL) carried out an online check on the google.fr website. The CNIL then found several violations of the rules relating to cookies, contained in [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the French Data Protection Act] (Loi Informatique et Libertés), as transposed from the e-Privacy Directive. *Is the French DPA materially and territorially competent to control and sanction cookies deposited by companies on users' computers? More specifically, is the lead authority mechanism as detailed in [https://gdprhub.eu/index.php?title=Article_56_GDPR Articles 56] and [https://gdprhub.eu/index.php?title=Article_60_GDPR 60 GDPR] applicable in this case? *Are Google LLC and Google Ireland LTD to be considered as joint controllers within the meaning of [https://gdprhub.eu/index.php?title=Article_26_GDPR article 26 GDPR]? *Does an information banner at the bottom of the page referring to the privacy policy constitute information in compliance with Article 82 of the French Data Protection Act (prior, clear and complete information on the purposes and rights of the persons concerned)? *Does the deposit of a cookie for advertising purposes require the prior consent of the persons concerned under Article 82
Violations (6)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Tracking cookies remain active or are re-placed even after the user explicitly rejects them.
Art. 6(1) GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Art. 12, 13 GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Google Ireland Ltd in FR
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
7 December 2020
Authority
Commission Nationale de l'Informatique et des Libertés
Fine Amount
€100,000,000
GDPRhub ID
gdprhub-2992About this data
Cite as: Cookie Fines. Google Ireland Ltd - France (2020). Retrieved from cookiefines.eu
Last updated: