The Conseil d'Etat today confirmed two fines totalling €100 million against Google by the French Data Protection Authority (CNIL). The Conseil d'Etat found that Google had not complied with its obligations to obtain the consent of its users regarding the use of online trackers. It ruled that the fines imposed by the CNIL were not disproportionate for Google, particularly in view of the significant profits generated by advertising cookies.
In December 2020, the CNIL ordered Google to pay two fines totalling €100 million1 for failing to comply with its obligation to obtain users' consent before installing cookies or other tracking devices (Article 82 of the French Data Protection Act, which transposes the 2002 European ePrivacy Directive). Google referred the matter to the Conseil d'Etat to have this sanction annulled.
In its decision, the Conseil d'Etat confirmed the CNIL's power to intervene, as well as its findings: lack of clear and complete information for users, failure to obtain their prior consent and a defective cookie refusal procedure. Indeed, the audit conducted by the CNIL in March 2020 revealed that seven cookies were automatically installed on users' computers as soon as they visited the site, four of which were only used for advertising purposes. During the audit procedure carried out by the CNIL, Google modified its practices in August 2020, but continued not to inform the user directly and explicitly about the purposes of its cookies and the means of objecting to them.
The Conseil d'Etat observes that the amount of the fines imposed by the CNIL does not exceed the limit set by the French Data Protection Act2 . And that in view of the significant profits generated by the data collected through advertising cookies, but also of Google's position in France (more than 90% market share, i.e. approximately 47 million users), these fines are not disproportionate.
For these reasons, the Conseil d'Etat rejects the request of Google to annul the fine imposed on it by the CNIL.
1Ruling SAN-2020-012 of 7 December 2020
2Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties