On 31^st December 2021 the French Data Protection Authority (the “CNIL”) imposed a €150,000,000 fine on Google and a €60,000,000 fine on Facebook (now Meta) for violations of French rules on the use of cookies.

The CNIL found that Google and Facebook had infringed Article 82 of the French Data Protection Act, by not providing an easy way for internet users to refuse cookies.

The websites allow users to accept cookies with only one click, but it takes several clicks to refuse cookies. The CNIL found that this affects the website users’ freedom of consent, as it influences users’ choice in favour of consent.

The CNIL has ordered the companies to change the websites, so they comply with French law within three months. Failure to do so will result in fines of €100,000 per day of delay.

The magnitude of the fines reflects the numbers of data subjects concerned, the amounts of data the websites have collected, as well as the profits obtained by the companies from advertising revenues made possible by the collected data.