France orders Google and Facebook to offer one-click cookie refusal

French regulators today ordered Google and Facebook to make rejecting cookies as easy as accepting them and imposed a total fine of 210 million euros on companies for failing to comply with French law on the protection of people. data.

The CNIL (National Commission for Computing and Liberties) noted that “facebook.com, google.fr and youtube.com offer a button allowing the user to immediately accept cookies” but “do not provide an equivalent solution (button or other) allowing the user to easily refuse the deposit of these cookies. Several clicks are necessary to refuse all cookies, against just one to accept them. “

The process making it more difficult to refuse cookies than to accept them “undermines the freedom of consent of Internet users and constitutes an infringement. Article 82 of the Data Protection Act ”, indicated the CNIL. The agency announced fines of 150 million euros for Google and 60 million euros for Facebook and indicated that it “urged companies to make available to Internet users located in France a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent, within three months . Otherwise, companies will have to pay a penalty of 100,000 euros per day of delay. “

The CNIL indicated that it had received numerous complaints from users concerning the two companies. In its announcement of the Google fine, the CNIL said it had determined that “the increasing complexity of the refusal mechanism actually deters users from refusing cookies and encourages them to opt for the facility of the ‘I accept’ button”. With Facebook, “to refuse the deposit of cookies, Internet users must click on a button entitled ‘Accept cookies’, displayed in the second window … that it is not possible to refuse the deposit of cookies and that they have no way of handling it. ”

Fines based on advertising revenue

The agency said it calculated each fine on the basis “of the number of people affected and the considerable profits the company derives from advertising revenue generated indirectly from the data collected by cookies.” But the penalties won’t make a big dent in either company’s earnings. Google owner Alphabet reported $ 65.1 billion in revenue and $ 18.9 billion in net income in its most recent quarter, while Facebook reported $ 29 billion in sales and $ 9.2 billion in net income.

New cookie rules for websites and mobile applications Took effect March 31, 2021. Since that date, “the CNIL has adopted nearly 100 corrective measures (orders and sanctions) related to non-compliance with legislation on cookies,” the agency said.

Google and Facebook vague about planned changes

When contacted by Ars, neither Google nor Facebook commented on exactly how they would change their cookie policies to comply with the ruling. A Google spokesperson said: “People trust us to respect and protect their right to privacy. We understand our responsibility to protect this trust and we are committed to making new changes and working actively with the CNIL in light of this decision under the ePrivacy directive. “

Facebook owner Meta told Ars, “We are reviewing the authority’s decision and remain committed to working with the appropriate authorities. Our cookie consent controls give people greater control over their data, including a new settings menu on Facebook and Instagram where people can review and manage their decisions at any time, and we continue to develop and improve these controls. . “