Facebook Ireland Limited – €60,000,000 Fine (France, 2021)

€60,000,000Commission Nationale de l'Informatique et des Libertés31 December 2021France
final
ePrivacy
Fine

Facebook Ireland Limited was fined EUR 60 million by France's CNIL for making it difficult for users to refuse cookies. The company had set up its cookie consent process so that rejecting cookies required more effort than accepting them. This ruling is significant for ensuring user consent is respected.

What happened

Facebook's website made it challenging for users to reject cookies, requiring several clicks to do so.

Who was affected

French users visiting facebook.com whose browsing was tracked by cookies.

What the authority found

The CNIL ruled that Facebook's cookie consent process violated French data protection laws by complicating the rejection of cookies.

Why this matters

This case underscores the need for clear and accessible consent mechanisms. Companies should evaluate their cookie policies to ensure they comply with user consent requirements.

GDPR Articles Cited

AI-verified

Art. 82 Loi Informatique et Libertés GDPR
View original scraped data
Art. 82 Loi Informatique et Libertés

Original data from scraper before AI verification against source document.

National Law Articles

AI-identified

Article 82 Loi "Informatique et Libertés"
Source verified 2 April 2026
articles corrected
national law identified
authority corrected
Full Legal Summary
Detailed

Facebook Ireland Limited (hereafter 'FIL') is a subsidiary owned wholly by Meta Platforms Inc. In April 2021 the French DPA (CNIL) carried out an online inspection of the website "facebook.com" in the context of an investigation into the processing of the personal data of French individuals visiting the website. The purpose of this inspection was to verify the company's compliance with the Loi 'Informatique et Libertés', and in particular with Article 82 thereof. In September 2021, the case manager that carried out the inspection issued a report to the restricted panel (that ultimately determines whether a breach occurred) that recommended the latter issue a fine and an injunction (to bring its processing activities into compliance with Article 82 Loi 'Informatique et Libertés') against the company. The restricted panel considered the evidence that was gathered by the case manager, and drew the conclusions below. = First, the CNIL had to justify that it was the competent authority in this case. == FIL argued the CNIL was not the competent authority because the alleged breach did not fall within the material scope of the ePrivacy Directive. However, the CNIL considered the contrary, namely that it was materially competent under the Loi 'Informatique et Libertés' (which implemented the ePrivacy Directive) to monitor and sanction the access or registration of information by companies in the terminals of users of the "facebook.com" website in France. After a lengthy discussion of national authorities' powers under the "one-stop shop" mechanism provided for by the GDPR, the CNIL held that it was in fact competent to control and initiate a sanction procedure against the aforementioned processing, provided that the latter was related to its territorial jurisdiction. == The CNIL considered it was territorially competent under Article 3 GDPR since the processing that was the subject of the present procedure, namely consisting of accessing or recording information on

Violations (4)

No Reject Button
critical

Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.

Art. 7 GDPR

Reject Harder Than Accept
critical

Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.

Art. 7 GDPR

Cookies Placed Before Consent
critical

Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.

Art. 6(1) GDPR

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Related Enforcement Actions (0)

No other enforcement actions found for Facebook Ireland Limited in FR

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

31 December 2021

Authority

Commission Nationale de l'Informatique et des Libertés

Fine Amount

€60,000,000

GDPRhub ID

gdprhub-4505

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Facebook Ireland Limited - France (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: