Microsoft Ireland Operations Limited – €60,000,000 Fine (France, 2022)

On 21 February 2020, the French DPA, the National Commission for Computing and Liberties (CNIL), received a complaint directed at Microsoft Ireland Operations Limited (MIOL) regarding their domain "bing.com", a search engine. The complaint prompted the DPA to launch an investigation into "bing.com" to verify its compliance with the French law implementing the ePrivacy-Directive, the French "Data Protection Act", and the GDPR. In their investigation, the DPA's commissioned investigator, the "rapporteur", found issues regarding both (1) a lack of compliance with the obligation to acquire users' consent to install non-essential cookies on users' terminals and (2) a shortcoming of the consent that was acquired, since it did not meet the required legal conditions to be considered "valid" consent. The rapporteur presented their findings to be considered by the DPA. MIOL was given the opportunity to reply to the rapporteur's findings. On the topic of the first issue, the rapporteur reported that upon arrival of the bing.com site, and before any actions by the users were taken, a multi-purpose cookie named "MUID" was placed on the user's terminal. Upon request, MIOL explained that the cookie was used for advertisement purposes if users consented to it. However, if no consent was provided, the cookie was used for the detection of advertising fraud concerning non-targeted advertising. According to the rapporteur, the "broader purpose of contextual advertising" excluded the cookie from the consent exemptions of the Article 82 of the French Data Protection Act (implementing Article 5 of the ePrivacy-Directive), which is only applicable when (i) the cookie's exclusive purpose is to "allow" or "facilitate" communications by electronic means or (ii) the cookie is "strictly necessary for the provision of an online communication service at the express request of a user". The MIOL argued in response that fighting advertising fraud is strictly necessary for their service to ensure