- CNIL verhängte hohe Bussen gegen Google (EUR 100 Mio. gesamt) und Amazon (EUR 35 Mio.) wegen unzulässiger, nicht einwilligungsbasierter Cookie-Platzierung.
- Informationsbanner und Opt-out-Mechanismen waren unzureichend; Google LLC und Google Ireland wurden gemeinsam als für die Datenverarbeitung verantwortlich eingestuft.
The French data protection authority CNIL has taken legal action in connection with the use of cookies against both Google (Délibération SAN-2020 – 012 of December 7, 2020.) as well as against Amazon (Délibération SAN-2020 – 013 of December 7, 2020.) imposed heavy fines.
Specifically, this concerns violations of Art. 82 “Loi Informatique et Libertés”. This implements Art. 5 (3) of the ePrivacy Directive in French law and requires explicit consent for the use of cookies.
Regarding google.fr states the CNIL (E. 77 et seq.):
- that cookies for marketing purposes, which are not necessary for the provision of Google services, have been automatically placed on users’ devices without their prior consent;
- that the information banner with two buttons “later remember” and “show now” and did not give users any information about the automatic placement of cookies on their devices;
- that the opt-out mechanism was partially defective. When personalized ads were deactivated, a marketing cookie remained on users’ devices.
Also regarding amazon.fr the CNIL reprimanded the automatic placement of cookies without consent. The information banner “By using this website, you agree that we use cookies to provide and improve our services.” was also insufficient. In particular, users did not receive any information on the possibility of revocation (E. 67 et seq.).
The fine of EUR 35 million is directed against Amazon Europe Core. The fine for Google is EUR 60 million against Google LLC and EUR 40 million against Google Ireland Ltd. According to the CNIL, Google LLC and Google Ireland Ltd. jointly determine the purposes and means of data processing, i.e. the placement of cookies on the devices of users of google.fr. They are thus jointly responsible for this data processing (E. 58 et seq.).