Google LLC – €150,000,000 Fine (France, 2021)
France's data protection authority fined Google LLC €150 million for not allowing users to easily refuse cookies. This matters because it shows that companies must make it clear how to manage cookie preferences. Website operators should ensure their cookie consent options are user-friendly and transparent.
What happened
Google tracked users on its website and placed cookies before obtaining proper consent.
Who was affected
Website visitors using Google services who were not given a clear option to refuse cookies.
What the authority found
The authority ruled that Google violated data protection rules by making it harder for users to reject cookies than to accept them.
Why this matters
This decision highlights the importance of clear cookie consent mechanisms. Other companies should review their cookie practices to avoid similar penalties.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Entities Involved
Google LLC is a subsidiary owned wholly by Alphabet Inc. Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and Switzerland. In March 2020 the French DPA (CNIL) carried out an online inspection of the website "google.fr" in the context of a previous procedure against Google LLC and GIL. The purpose of this inspection was to verify their compliance with the Loi 'Informatique et Libertés', and in particular with Article 82 thereof. This resulted in this decision, that Google appealed. Following this decision, the CNIL received more complaints about the methods of refusing cookies from the website "google.fr". It therefore reopened the case and launched a new investigation. = First, the companies requested that per Article 66 of the CNIL's rules of procedure, the CNIL stay these proceedings pending the decision to be handed down by the Council of State in the appeal against its first decision against Google and pending the conclusions of the new EDPB working group on cookies. The CNIL rejected this request, as it considered that there were no acceptable grounds for staying the proceedings. = Second, the companies argued that the restricted formation cannot rule again on the same facts as those concerned by deliberations No. SAN-2020-012 and [https://www.cnil.fr/en/termination-injunction-against-google No. SAN-2021-004], without violating the ne bis in idem principle, as it considered the parties and material facts in those case to be identical. The CNIL responded that the two procedures do not concern the same facts, as these cases included an injunction relating to the information of users on the purposes of cookies subject to consent and on the means available to refuse cookies, whereas the one at hand concerned the refusal methods themselves, and not only the information. It also highlighted that this procedure concerned both the websites "google.fr" and "youtube.com", whereas the previous procedur
Violations (4)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Art. 12, 13 GDPR
Related Enforcement Actions (5)
Other enforcement actions involving Google LLC in FR
Fine
€150.0M
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
31 December 2021
Authority
Commission Nationale de l'Informatique et des Libertés
Fine Amount
€150,000,000
GDPRhub ID
gdprhub-4483About this data
Cite as: Cookie Fines. Google LLC - France (2021). Retrieved from cookiefines.eu
Last updated: