Google and Facebook have both been fined by French regulators for improper tracking procedures.
The companies were fined a total of 210 million euros, or more than $237 million, after an independent oversight authority investigated how users were able to opt-out of online tracking. In its investigation, the Commission Nationale de l’Informatique et des Libertés (CNIL) found that users were only given a button to accept cookies but not one to deny them. It said that “several clicks are required to refuse all cookies” on the websites.
“The restricted committee considered that this process affects the freedom of consent,” the CNIL wrote in its investigation. “On the Internet, the user expects to be able to quickly consult a website, the fact that they cannot refuse the cookies as easily as they can accept them influences their choice in favor of consent.”
As a result of the investigation, regulators fined Google 150 million euros, or $170 million. Facebook also received a hefty fine of 60 million euros. Both companies have spoken out about their policies, as well.
“Our cookie consent controls provide people with greater control over their data,” wrote Facebook’s parent company Meta in a statement, “including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls.”
Google also released a statement on the fines, saying that they “understand [their] responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision.”
Cookies are snippets of code used to target internet users for digital ads and other purposes. European governments have stricter regulations than the U.S. that require websites to ask for permission before tracking a user’s activity. That means people face pop-up menus when they visit new websites, but there’s been growing concern that many are configured to make it confusing or tedious if they don’t want to give consent.
Cookies have been a long-standing source of privacy concerns because they can be employed to track users across the internet. They can be used to help remember someone’s website log-in details or more controversially, to record someone’s web-browsing history to target personalized ads.
The French penalty underscores a broader shift in the digital ad industry as Google and Facebook, which dominate the market, and regulators in Europe and the U.S. work on phasing out more egregious data collection practices. Google has announced plans to phase out so-called third party cookies used by advertisers from its Chrome browsers, though it will still be able to track users of its own services.
The Associated Press contributed to this report.