Microsoft Ireland Operations Limited – €60,000,000 Fine (France, 2022)

On 21 February 2020, the French DPA, the National Commission for Computing and Liberties (CNIL), received a complaint directed at Microsoft Ireland Operations Limited (MIOL) regarding their domain "bing.com", a search engine. The complaint prompted the DPA to launch an investigation into "bing.com" to verify its compliance with the French law implementing the ePrivacy-Directive, the French "Data Protection Act", and the GDPR. In their investigation, the DPA's commissioned investigator, the "rapporteur", found issues regarding both (1) a lack of compliance with the obligation to acquire users' consent to install non-essential cookies on users' terminals and (2) a shortcoming of the consent that was acquired, since it did not meet the required legal conditions to be considered "valid" consent. The rapporteur presented their findings to be considered by the DPA. MIOL was given the opportunity to reply to the rapporteur's findings. On the topic of the first issue, the rapporteur reported that upon arrival of the bing.com site, and before any actions by the users were taken, a multi-purpose cookie named "MUID" was placed on the user's terminal. Upon request, MIOL explained that the cookie was used for advertisement purposes if users consented to it. However, if no consent was provided, the cookie was used for the detection of advertising fraud concerning non-targeted advertising. According to the rapporteur, the "broader purpose of contextual advertising" excluded the cookie from the consent exemptions of the Article 82 of the French Data Protection Act (implementing Article 5 of the ePrivacy-Directive), which is only applicable when (i) the cookie's exclusive purpose is to "allow" or "facilitate" communications by electronic means or (ii) the cookie is "strictly necessary for the provision of an online communication service at the express request of a user". The MIOL argued in response that fighting advertising fraud is strictly necessary for their service to ensure that the search engines search results are "relevant, reliable and safe". Moreover, the fight against advertising fraud is in the same line as the prevention of denial of service attacks, cybercrime, load balancing, and session-to-session continuity. Nevertheless, the rapporteur insisted that only the purpose of combating denial of service attacks could be exempt from consent and that other purposes, such as combating advertising fraud, would not be strictly necessary for the provision of a service pursuant to Article 82 Data Protection Act. Additionally, also related to the first issue, the rapporteur brought the cookie "ABDEF" to the attention of the DPA. The cookie was placed on a user terminal if the user continued to browse without giving consent. It also had an advertising purpose. MIOL responded that the cookie had been incorrectly categorized due to human error, was only placed for a short period, and is now subject to the collection of users' consent. MOIL invoked a "right to error" and argued that it had acted in good faith. Regarding the the second issue, the rapporteur noted that Article 2(f) of the ePrivacy Directive states that its definition of consent is to be understood in light of the consent of data subjects of Directive 95/46/EC (which - by then - had been replaced by the GDPR). Correspondingly, the consent of Article 82 Data Protection Act (implementing the ePrivacy-Directive) also is to be understood within the meaning of consent as defined in Article 4(11) GDPR. As explained by recital 42 GDPR, "[c]onsent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment." The rapporteur also pointed to two recommendations of the DPA (namely, recommendations no. 2020-091 and 2020-092) which state that to be valid a consent for the activation of cookies must be as easy to refuse or withdraw as it is to give it. The principle of freedom of consent would imply a necessity of a "true freedom of choice" which require consent mechanisms which allow users to express consent by being offered unbiased choices. This would not be fulfilled if, as is often the case, users are forced to go through more click-through levels of a cookie banner to refuse cookies than it takes them to accept cookies. After visiting MIOL's website "bing.com" on 11 May 2021, the rapporteur was confronted with a website allowing cookies to be accepted immediately while no similar means were offered to the user to refuse cookies. The refusal of cookies would require at least two more actions than it would take to accept them. Additionally, the use of the infinitive "Disable" - which would in principle imply a necessity to take action - would be ambiguous and confuse users. Consequently, "bing.com" would be in violation of Article 82 Data Protection Act. In its defence, MIOL argued that neither the ePrivacy-Directive, nor its transposition, the French Data Protection Act, nor the GDPR provide for a rule requiring that it must be as easy to refuse cookies as it is to accept them. The cited recommendations of the DPA, on the other hand, would not be non-binding. MIOL explained that it had relied on a preference management system which relied on explicit consent before placing non-essential cookies on a user's terminal. Non-essential cookies would only be activated after a user had clicked the "Accept button" and not if the user either pressed "save settings" or continued to browse. On the first set of issues, the DPA considered that Article 82 of the French Data Protection Act requires consent for the operation of cookies on user terminals, but provides for specific exemptions, such as when a cookie is strictly necessary for the provision of an online communication service which a user requested. However, cookies which fulfil multiple purposes, including both essential and non-essential ones, would not fall under this exemption. In regard to the cookie "MUID", which serves the broader purpose of contextual advertising, MIOL appears to confuse the necessity of the cookie for the distribution of advertising, which a user did not request, with the impact of the cookie on the technical functionality of the search engine. Consequently, since the provision of advertisement was not strictly necessary for provision of the search engine service, the DPA held that the cookie "MUID" did not meet the exemption of Article 82 Data Protection Act. Regarding the miscategorised cookie "ABDEF", the DPA argued that, even if was not done intentionally, its placement without prior consent was a result of gross negligence. Moreover, the cookie was only rectified after the DPA's investigation. Therefore, the DPA considered this another violation of Article 82 Data Protection Act. On the second issue, the DPA recalled its guidelines, which state that if a user's consent to cookies ought to be deduced from the user's silence, it is only on condition that the user is fully informed. Otherwise, there would be an imbalance between the methods of giving and denying consent. The DPA held that this imbalance was the case in the present circumstances. Users would not be aware that a lack of action would equally be a rejection of cookies as the pressing of a reject button would be. A user wishing to refuse cookies was given the impression that they would have to click on the "More options" button in order to find the reject option, while they were presented with an "Accept" button on the first level of the cookie banner. Additionally, the not explicit nature of the "More options" button and the ambiguity of the used infinitive "Disable" on the rejection button further caused confusion for data subjects. Moreover, the DPA noted that serval studies had proven that a "Refuse all" button on the first level of a cookie banner significantly reduced the rate of consent. More complex cookie acceptance mechanisms unjustifiably bias users towards accepting rather than refusing cookies. As a result, the DPA considered the foregoing considerations another violation of Article 82 Data Protection Act. Even though "bing.com" was, as argued by MIOL, in a fragile position in a search engine market dominated by a single player, the DPA considered the massive nature of the illegal processing of data, affecting 11 million unique visitors in September 2020, the position of "bing.com" as second strongest player in the search engine market, its default use for queries made with Windows machines, and the financial benefits obtained by MIOL through the breach when assessing the height of its fine. The DPA sanctioned MIOL EUR 60,000,000 and issued an injunction to rectify its cookie implementation under the threat of a penalty payment of EUR 60,000 per day of delay of the DPA's given deadline.