This article is more than 1 year old

France fines Google, Amazon €135m total for slipping ad cookies into people's computers without permission

We're sure these websites will find some way to rebound from this incredible punishment

Google and Amazon have been slapped with €100m and €35m fines respectively after France’s data privacy watchdog declared both companies had placed advertising cookies on people’s computers without their consent.

The National Commission on Informatics and Liberty (CNIL) announced on Thursday that both internet goliaths had secretly slipped cookies on users' computers whenever they accessed the Amazon’s e-commerce bazaar and Google’s search engine in France. Under the French Data Protection Act, companies must obtain explicit consent to deploy cookies that enable targeted adverts personalised for individual netizens.

Google and Amazon, however, automatically placed the web cookies without people knowing, we're told. CNIL also said they failed to provide clear explanations disclosing what the cookies were being used for and how users could opt-out, beyond generic messages, specifically Amazon’s “By using this website, you accept our use of cookies allowing us to offer and improve our services,” and Google’s “Privacy reminder from Google” with two buttons labeled “Remind me later” and “Access now”.


French data watchdog dishes out largest GDPR fine yet: Google ordered to hand over €50m


The Chocolate Factory, however, has been accused of breaking a third rule. Although people could deactivate personalized ads, Google continued to store one of its advertising cookies nonetheless, it is said.

CNIL investigated both super-giants for months in 2019, and noted that they have both improved their practices since. Google stopped surreptitiously slipping cookies into the PCs of French users when it updated its site in September, and Amazon has improved customer notifications of its cookie policy in line with the law.

The Google €100m will be split with €60m to be paid by Google and €40m by its subsidiary Google Ireland. Amazon Europe Core in Luxembourg is expected to pay the €35m. Both corporations bank billions a year in profit, mind.

“The restricted committee justified these amounts having regard to the seriousness of the breach of Article 82 of the French Data Protection Act, that has been observed in relation with three aspects,” it said in a statement about Google.

“It also highlighted the scope of the search engine Google Search in France and the fact that the practices of the companies affected almost fifty million users.”

An Amazon spokesperson told The Register: “We disagree with the CNIL’s decision. Protecting the privacy of our customers has always been a top priority for Amazon. We continuously update our privacy practices to ensure that we meet the evolving needs and expectations of customers and regulators and fully comply with all applicable laws in every country in which we operate.”

We’re still waiting to hear back from Google. ®

More about


Send us news

Other stories you might like