Facebook Ireland Limited – €60,000,000 Fine (France, 2021)
Facebook Ireland Limited was fined EUR 60 million by France's CNIL for making it difficult for users to refuse cookies. The company had set up its cookie consent process so that rejecting cookies required more effort than accepting them. This ruling is significant for ensuring user consent is respected.
What happened
Facebook's website made it challenging for users to reject cookies, requiring several clicks to do so.
Who was affected
French users visiting facebook.com whose browsing was tracked by cookies.
What the authority found
The CNIL ruled that Facebook's cookie consent process violated French data protection laws by complicating the rejection of cookies.
Why this matters
This case underscores the need for clear and accessible consent mechanisms. Companies should evaluate their cookie policies to ensure they comply with user consent requirements.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Facebook Ireland Limited (hereafter 'FIL') is a subsidiary owned wholly by Meta Platforms Inc. In April 2021 the French DPA (CNIL) carried out an online inspection of the website "facebook.com" in the context of an investigation into the processing of the personal data of French individuals visiting the website. The purpose of this inspection was to verify the company's compliance with the Loi 'Informatique et Libertés', and in particular with Article 82 thereof. In September 2021, the case manager that carried out the inspection issued a report to the restricted panel (that ultimately determines whether a breach occurred) that recommended the latter issue a fine and an injunction (to bring its processing activities into compliance with Article 82 Loi 'Informatique et Libertés') against the company. The restricted panel considered the evidence that was gathered by the case manager, and drew the conclusions below. = First, the CNIL had to justify that it was the competent authority in this case. == FIL argued the CNIL was not the competent authority because the alleged breach did not fall within the material scope of the ePrivacy Directive. However, the CNIL considered the contrary, namely that it was materially competent under the Loi 'Informatique et Libertés' (which implemented the ePrivacy Directive) to monitor and sanction the access or registration of information by companies in the terminals of users of the "facebook.com" website in France. After a lengthy discussion of national authorities' powers under the "one-stop shop" mechanism provided for by the GDPR, the CNIL held that it was in fact competent to control and initiate a sanction procedure against the aforementioned processing, provided that the latter was related to its territorial jurisdiction. == The CNIL considered it was territorially competent under Article 3 GDPR since the processing that was the subject of the present procedure, namely consisting of accessing or recording information on
Violations (4)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Facebook Ireland Limited in FR
This is the only recorded action for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
Fine Date
31 December 2021
Authority
Commission Nationale de l'Informatique et des Libertés
Fine Amount
€60,000,000
GDPRhub ID
gdprhub-4505About this data
Cite as: Cookie Fines. Facebook Ireland Limited - France (2021). Retrieved from cookiefines.eu
Last updated: