TikTok – €5,000,000 Fine (France, 2022)

The French DPA (DPA) started an investigation on 14 may 2020 into TikTok's website (the 'service provider' or 'the company'). The DPA also inquired on TikTok's cookie use with a particular focus on whether/how the provider deposited and/or accessed cookies and other trackers on French-located users' devices. The investigation ascertained different elements. First, the company had a French establishment (TIKTOK SAS) tasked with the sale and promotion of advertising on the French market. The employees of this establishment worked with advertisers to target local audiences with personalised ads. Second, TikTok's cookie banner on the main TikTok website (Tiktok.com), allowed users to accept all cookies with a single click using a single button. It was possible to deny cookies, such as using the 'manage consent' button, but these methods required more steps when compared to accepting cookies. Third, even if a user did not consent to their installation, certain advertising cookies would nonetheless be placed. The DPA also found that in the case a user had consented to the use of cookies on the main website, cookies would also be placed on the user's device when this user would navigate to one of TikTok's subdomains, with no consent request in those cases. Material competence of the French DPA The DPA determined that it was materially competent. It considered Articles 16 and 20 of the French data protection act and two decisions from the French Conseil d'Etat, in which it was stated that operations regarding the use of trackers on users' devices, located on French territory, fell within the competence of the French DPA. One of these decisions was the [https://gdprhub.eu/index.php?title=CE_-_449209 Conseil's decision of 28 January 2022 (Societe GOOGLE LLC and Societe GOOGLE IRELAND LIMITED]). Territorial competence of the French DPA In order to assess if the DPA was territorially competent to handle this decision under Article 3 of the French Data Protection Act,