On December 7 2020, the French Supervisory Authority (CNIL) sanctioned Google LLC (60 million EUR) and Google Ireland (40 million EUR) for installing advertising cookies on users devices without their prior consent and with proper information.

In addition, the CNIL issued an injunction to inform properly the users of google.fr in compliance with Article 82 of the French Data Protection Act within three (3) months from the notification of this decision with a late payment penalty of 100.000 EUR per day.

How was the CNIL aware of the infringement?

The CNIL carried out a control on line on Google’s web site, google.fr, on March 16, 2020 and noted three categories of infringements to article 82 of the French Data Protection Act implementing the provisions on cookies of the e-privacy directive, requiring “consent and information of the user of an electronic communication service for any action aiming at accessing information stored or writing information on said user’s device”.

What kind of infringements were sanctioned?

• Absence of consent prior to cookies installation
  Each time a user was accessing the google.fr website, cookies were automatically installed on her/his computer, without any action on her/his side. The purpose of several cookies was advertising and not essential cookies for the provision of the services.
• No information of the search engine users
  When accessing the site, a banner indicating “Reminder of Google Privacy policy” was displayed” together with two buttons “remind me later” and “read now”. However, no information was provided on cookies neither at the time a visitor was arriving on the site, nor once accessing the privacy policy by clicking on the button “read now”. Therefore, the CNIL states that users residing in France were not clearly informed of the cookies deposit on their computer as well as the purposes of such cookies and their right to object, prior to their installation.
• Partial failure of the right to object mechanism
  When a user deactivated the customized advertising by using the feature available through the button “read now”, one of the advertising cookies was still stored on the computer and continued to collect data to send it to the server. The CNIL considered that there was thus a failure of the right to object mechanism.

Why are the applied sanctions so high?

The CNIL justifies the high level of sanction by several factors:

• the triple infringement to Article 82 of the French Data Protection Act
• the large scale impact of Google search engine in France which affected almost 50 millions of users
• the huge amount of profits generated by Google advertising activity notably based on the cookies advertising at stake
• the CNIL notes that even if further to an update on September 2020, Google stopped to deposit advertising cookies automatically when the users arrive on google.fr, the new information banner does not still allow users residing in France to have a clear understanding of the purposes of the cookies and are not informed on their right to object.

The CNIL thus issued an injunction to inform the data subjects in compliance with Article 82 of the Data Protection Act within three months as from the notification of the CNIL’s decision, subject to a late payment penalty of 100.000 EUR per day.

It should be noted that the respective turnover of Google entities are:  for Google LLC – 160 billion USD, Google Ireland Limited – 38 billion EUR and for Google France – 400 million EUR.

Was the CNIL competent since the Irish Authority has been appointed by Google as the Lead Authority?

Anticipating the challenges regarding its competence, the CNIL reminds on its website that:

• it remains materially competent to control and sanction the deposit of cookies on the devices of users residing in France.

According to the CNIL, the “one stop shop” mechanism provided by the GDPR is not applicable to this particular case as it deals with actions related to the usage of cookies resulting from the “e-Privacy” directive as implemented by Article 82 of the French Data Protection Act.

• It is also territorially competent pursuant to Article 3 of the French Data Protection Act as the cookies are used by Google France in the context of its activities as the establishment of Google LLC and Google Ireland Limited on the French territory where it promotes their products and services. The CNIL retains the responsibility of Google LLC and Google Ireland Limited as joint controllers determining the purposes and means of the processing resulting from the cookies used on the French version of the search engine.

Was the CNIL able to sanction despite the transition period of 6 months granted from the date of publication of the final version of its guidelines and recommendation of October 1 2020 on cookies and other trackers?

When releasing these guidelines and recommendations, the CNIL already informed that despite such transition period, it will continue to control the compliance with existing obligations. The non-compliances sanctioned do not relate to obligations that were clarified by the new guidelines and recommendations.

Google may  now log an appeal against the CNIL’s decision before the Council of State which is the highest Administrative Court, like it already did when it was previously sanctioned by a 50 million EUR of fine by CNIL but was unsuccessful at that time as the Council of State confirmed the CNIL’s decision.

Denise Lebeau-Marianna, Yaël Hirsch, Alexandre Balducci – DLA Piper France LLP

A recent focus towards the law on cookies in Europe by the courts regulators has highlighted the different approaches to the interplay between the GDPR and ePrivacy, and indeed the interpretation of the ePrivacy Directive more generally. DLA Piper have produced a European Cookie Guide, consolidating the regulatory guidance from across Europe and containing the main areas of focus for each jurisdiction, including key enforcement trends which multinational organisations should be aware of.

To find out more and access our European Cookie Guide, please click here.