On 7 December 2020, the CNIL (the French data protection authority) imposed substantial fines on both Google and Amazon in relation to alleged breaches of French data protection laws. The CNIL fined Google LLC and Google Ireland Limited (“Google”) €60 million and €40 million respectively, whilst Amazon Europe Core received a fine of €35 million. These fines were for alleged violations of cookie notice and consent requirements, and represent the largest fines ever imposed by the CNIL.
Amazon was alleged to have committed two breaches under Article 82 of the French Data Protection Act. This included:
- depositing cookies without obtaining prior consent of the user; and
Amazon set cookies on users' devices once the user had entered the site without requiring any action from them (i.e. consent to their use). As such, they placed advertising cookies on the computer of the user before obtaining their consent. Additionally, there was a lack of information on the website explaining to the user what cookies were being used and why. In particular, it was not made clear to users that the cookies were mainly for the purposes of displaying personalised advertisements, and that they could opt out of such cookies at any time.
Google was also fined for a third breach in relation to their opt-out mechanism. Not only did they fail to display the possibility to opt out in their cookie consent banner, it was also discovered that some of the cookies continued to operate despite the user opting out.
What can we learn from these fines?
Second, in informing users, organisations should ensure that any banners providing information on cookie use should include key information such as what the cookies will be used for and the ability for users to opt out. This information should be made as clear as possible without users having to search for it (e.g. by clicking on a link).
How can we help?
For further information on cookie notices and gaining consent from users to place cookies, please get in touch with our specialist GDPR & Cyber Security team.