Google and Amazon fined for cookies breach by French privacy regulator

LONDON — France’s data protection regulator, the Commission nationale de l’informatique et des libertés, issued Google and Amazon with substantial fines on Thursday for breaking rules on online advertising trackers, known as cookies.

The watchdog ordered Google to pay 100 million euros ($121 million) and Amazon to pay 35 million euros.

The CNIL said both companies had breached Article 82 of the French Data Protection Act, with Google committing three offences and Amazon committing two.

The companies were fined for placing tracking cookies on their user’s computers in France “without obtaining prior consent and without providing adequate information.”

Cookies allow tech giants to “follow” their users around the internet so that they can serve them with personalized ads.

Google was also fined for tracking users who had specifically deactivated ad personalization.

The CNIL said Amazon and Google had 90 days to change the information banners it shows users on cookies. If they fail to make the necessary changes, they will face an additional fine of 100,000 euros per day until the modifications are made.

A Google spokesperson said: “People who use Google expect us to respect their privacy, whether they have a Google account or not. We stand by our record of providing upfront information and clear controls, strong internal data governance, secure infrastructure, and above all, helpful products.”

They added: “Today’s decision under French ePrivacy laws overlooks these efforts and doesn’t account for the fact that French rules and regulatory guidance are uncertain and constantly evolving. We will continue to engage with the CNIL as we make ongoing improvements to better understand its concerns.”

Amazon said it disagreed with the CNIL’s decision. 

“Protecting the privacy of our customers has always been a top priority for Amazon,” said an Amazon spokesperson. “We continuously update our privacy practices to ensure that we meet the evolving needs and expectations of customers and regulators and fully comply with all applicable laws in every country in which we operate.”

The fines on the U.S. tech giants are the latest in a string of punishments to be handed out by European regulators.

Next week, the European Commission, the executive arm of the European Union, is set to announce a new Digital Services Act that will likely have major ramifications for the world’s largest tech firms.