Difficult For Internet Users To Reject Cookies, Google Gets A Record Of Fines From CNIL

JAKARTA - The French Data Privacy Regulatory Authority (CNIL) said on Thursday, January 6 that it had fined Alphabet Google with a record fine of 150 million euros (Rp2.4 trillion. The fine was due to Google being accused of making it difficult for internet users to refuse online trackers known as cookies.

In addition to Google, CNIL also fined Facebook or Meta Platforms Inc 60 million euros (Rp974 billion) for the same reason.

Internet users' prior consent to the use of cookies, which are small pieces of data that help to build targeted digital advertising campaigns, is a key pillar of EU data privacy regulation and a top priority for CNIL.

"When you receive a cookie, it is done in just one click. Rejecting a cookie should be as easy as accepting it," said Karin Kiefer, CNIL's head of data protection and sanctions, as quoted by Reuters.

In a statement, CNIL said it had found that the sites facebook.com, google.fr, and youtube.com did not allow easy rejection of cookies. It cites Google's video streaming platform.

CNIL said the two companies had three months to comply with its orders or face paying an additional 100,000 euros (Rp1.6 billion) per day for late payments.

This includes an obligation for Google and Facebook to provide internet users in France with a simpler tool to refuse cookies, and guarantee their consent.

CNIL says that while Google and Facebook currently provide virtual buttons to allow direct acceptance of cookies, no buttons are provided to easily reject them.

"The public trusts us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committed to further changes and are working actively with CNIL regarding this decision," a Google spokesperson said. Facebook did not immediately respond to a request for comment on the case.

CNIL's previous record fine in 2020 was also addressed to Google of 100 million euros. At that time, CNIL found that the French Google website did not ask for the visitor's prior consent, before the advertising cookie was stored on the computer and failed to provide clear information on how to use it. Kiefer said the issue had been resolved since then.

In 2020, CNIL strengthened its right of consent to ad trackers, saying websites operating in France must maintain a list of internet users' refusal to accept cookies, for at least six months.

It also said that internet users should be able to easily reconsider any initial agreement regarding cookies via web links or icons which should be visible on all pages of the website.