Yahoo EMEA Limited – €10,000,000 Fine (France, 2023)

Between 12 June 2019 and 2 October 2020, the French DPA ("CNIL") received 27 complaints, concerning among other things, the deposit of cookies on the data subjects terminals before any action was taken, as well as the failure to take into account their refusal to the deposit of these cookies. Following these complaints, the CNIL carried out online investigations of the "yahoo.com" website and the "Yahoo mail" messaging service. The first investigation consisted of two scenarios: during a first scenario, the CNIL found that at least 20 cookies for advertising purposes had been placed on their terminal even though they had not expressed consent. They also discovered that on the Yahoo page, there was a "Your data. Your experience" window which included an "I accept" and "Manage settings" button. The "Manage settings" button used push buttons which were activated by default. The CNIL did not activate any of the buttons and clicked "Save and continue" but still noted the deposit of 26 cookies, 7 of which were used for advertising purposes. During a second scenario, the CNIL browsed on "yahoo.com" in order to create a "Yahoo mail" account. As in the first scenario, the CNIL did not express consent to the deposit of cookies. During this investigation, they also discovered that when a user tried to withdraw their consent, a window was displayed and indicated that "You must accept them to be able to use Verizon Media products. If you disable them, you revoke your consent and will no longer be able to access Verizon Media products, including Yahoo Mail, Yahoo News, Huffington Post, etc." The CNIL clicked on the "Find out more" link where there were questions, such as "What happens if I withdraw my consent to cookies from the privacy dashboard? "and that the answer to this question stated that while "users in the European Union can withdraw this cookie agreement for their account from the privacy dashboard", "withdrawing this agreement will result in blocked access to our products and other Verizon Media sites and applications". During its second inspection, the CNIL also discovered that when browsing on "Yahoo.com" without creating an account, a data subject could revoke their consent from a page entitled "Privacy dashboard and controls (visitors)", but when doing so, a page appeared followed by the words "Are you sure? You will no longer be able to access YAHOO or other Verizon Media products". The CNIL started a sanctioning procedure on 10 July 2023. Firstly, regarding the material scope of the CNIL's jurisdiction, the DPA indicated that with regard to a Conseil d'Etat decision, the control tied to a cross-border processing, falls within the jurisdiction of the CNIL and the one-stop shop mechanism provided by the GDPR is not applicable. Therefore, the CNIL considered that they are competent to monitor and initiate sanctioning proceedings concerning the processing implemented by the controller as it fell within the scope of the ePrivacy directive, which is lex specialis to the GDPR. Regarding the territorial scope of the CNIL's jurisdiction, the CNIL indicated that under [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the law "Informatique et Libertés"] ("LIL"), they are competent, as the processing in this case was carried out as part of the activities of an establishment of the controller on the French territory. In particular, the CNIL took into account the purpose of the controller, which is, among other things, "to promote Yahoo's advertising products and solutions on the French market (...)". Therefore, the CNIL concluded that the processing consisting of operations to access or record information in the terminal of data subjects residing in France, when browsing "yahoo.com" or using the "Yahoo mail service" is carried out in the context of the activities of Yahoo France. Thus, the CNIL found that French law is applicable, and that the CNIL is materially and territorially competent. Secondly, regarding the controllership, the CNIL noted that Article 4(7) GDPR applied due to the reference made by Article 2 of the ePrivacy directive. The CNIL considered that the controller indicated in a letter that they determine the purposes and means of the personal data processing, and is therefore a controller. Thirdly, concerning the absence of prior consent, [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the LIL] requires consent for operations involving the reading and writing of information on a data subject's terminal. Regarding what the CNIL found during its investigation concerning the absence of consent and the deposit of advertising cookies even though none of the buttons were activated, the DPA considered that numerous cookies requiring prior consent were deposited without collecting prior consent, therefore breaching [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the LIL]. The CNIL added that regarding cookies deposited by third parties, the French Supreme Administrative Court ruled that site publishers who authorize the deposit and use of such 'cookies' by third parties when their site is visited must also be considered as data controllers. Therefore, the DPA considered that the controller breached [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the LIL]. Finally, regarding the withdrawal of consent, the CNIL indicated that the withdrawal of consent must be possible under [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the LIL]. Consent under this Article must be understood within the meaning of Article 4(11) GDPR meaning it must be given freely, specifically, in an informed and unambiguous manner and manifested by a clear positive act. The CNIL noted that the controller only informed data subjects that the use of its services was conditional on acceptance of certain cookies during the withdrawal process. The CNIL considered that linking the use of a service to the registration of cookies that are not strictly necessary for the service provided is not in itself illegal, under the condition that consent is free, which implies that both the refusal of consent and its withdrawal are without prejudice to the data subject. The CNIL found that the it was not possible to withdraw consent without interrupting the services and noted that the absence of alternatives offered by the company necessarily affects the free nature of the withdrawal of consent. The DPA also considered that despite the presence of buttons allowing the withdrawal of consent, the messages that appeared were likely to constitute a serious obstacle for data subjects. The CNIL also observed that during the user paths it followed, the CNIL systematically clicked on buttons and tabs with intuitive headings such as "Your account", then "General consent" or "Find out more". Thus, the paths followed by the CNIL during the two online checks are those that users are most likely to follow when they wish to withdraw their consent. The CNIL therefore concluded that the controller breached [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the LIL] and imposed a €10 million fine.