Google LLC – €150,000,000 Fine (France, 2021)

€150,000,000Commission Nationale de l'Informatique et des Libertés31 December 2021France
final
ePrivacy
Fine

France's data protection authority fined Google LLC €150 million for not allowing users to easily refuse cookies. This matters because it shows that companies must make it clear how to manage cookie preferences. Website operators should ensure their cookie consent options are user-friendly and transparent.

What happened

Google tracked users on its website and placed cookies before obtaining proper consent.

Who was affected

Website visitors using Google services who were not given a clear option to refuse cookies.

What the authority found

The authority ruled that Google violated data protection rules by making it harder for users to reject cookies than to accept them.

Why this matters

This decision highlights the importance of clear cookie consent mechanisms. Other companies should review their cookie practices to avoid similar penalties.

GDPR Articles Cited

AI-verified

Art. 5(3) ePrivacy Directive GDPR
Art. 56(GDPR)
Art. 82 Loi Informatique et Libertés GDPR
View original scraped data
Art. 56(GDPR)
Art. 82 Loi Informatique et Libertés
Art. 5(3) ePrivacy Directive

Original data from scraper before AI verification against source document.

National Law Articles

AI-identified

Loi "Informatique et Libertés"

Entities Involved

Google LLC
Google Ireland Limited
Source verified 2 April 2026
articles corrected
national law identified
Full Legal Summary
Detailed

Google LLC is a subsidiary owned wholly by Alphabet Inc. Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and Switzerland. In March 2020 the French DPA (CNIL) carried out an online inspection of the website "google.fr" in the context of a previous procedure against Google LLC and GIL. The purpose of this inspection was to verify their compliance with the Loi 'Informatique et Libertés', and in particular with Article 82 thereof. This resulted in this decision, that Google appealed. Following this decision, the CNIL received more complaints about the methods of refusing cookies from the website "google.fr". It therefore reopened the case and launched a new investigation. = First, the companies requested that per Article 66 of the CNIL's rules of procedure, the CNIL stay these proceedings pending the decision to be handed down by the Council of State in the appeal against its first decision against Google and pending the conclusions of the new EDPB working group on cookies. The CNIL rejected this request, as it considered that there were no acceptable grounds for staying the proceedings. = Second, the companies argued that the restricted formation cannot rule again on the same facts as those concerned by deliberations No. SAN-2020-012 and [https://www.cnil.fr/en/termination-injunction-against-google No. SAN-2021-004], without violating the ne bis in idem principle, as it considered the parties and material facts in those case to be identical. The CNIL responded that the two procedures do not concern the same facts, as these cases included an injunction relating to the information of users on the purposes of cookies subject to consent and on the means available to refuse cookies, whereas the one at hand concerned the refusal methods themselves, and not only the information. It also highlighted that this procedure concerned both the websites "google.fr" and "youtube.com", whereas the previous procedur

Violations (4)

No Reject Button
critical

Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.

Art. 7 GDPR

Reject Harder Than Accept
critical

Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.

Art. 7 GDPR

Cookies Placed Before Consent
critical

Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.

Art. 6(1) GDPR

Unclear Cookie Information
high

The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.

Art. 12, 13 GDPR

Details

Fine Date

31 December 2021

Authority

Commission Nationale de l'Informatique et des Libertés

Fine Amount

€150,000,000

GDPRhub ID

gdprhub-4483

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified
Cookie relevance: 100%

Cite as: Cookie Fines. Google LLC - France (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: