For violating EU privacy regulations, Google Facebook may be fined more than 1.5 billion yuan

Recently, the French data regulator CNIL (French National Commission for Information and Freedom) will impose fines of 150 million euros (about 1.081 billion yuan) and 60 million euros (about 432 million yuan) on Google and Facebook for not allowing French users to easily refuse cookie tracking.

It is understood that cookies are data stored on the user's local terminal, which is used to store the user's password, browsing history and other information. While bringing convenience, the privacy issues of similar technologies such as cookies are also controversial.

On January 6, local time, CNIL announced the fine on its official website. CnIL said that an online survey of Facebook.com, Google.fr and YouTube.com websites found that while both sites offered buttons that allowed users to "immediately accept" cookies, the choice to refuse cookies was not just as easy – users needed multiple clicks to reject all cookies, while users only needed one click to accept cookies.

The CNIL argues that the user may choose to waive because the refusal mechanism is too complex, which amounts to "disguised forcing" the user to accept cookies, affecting the internet user's freedom of consent, and thus violating article 82 of the French Data Protection Act.

In addition to the fines, the CNIL also requires that Google and Facebook be fined 100,000 euros per day if they do not correct their practices within three months of the decision's release.

A spokesman for Facebook-affiliated Meta said it was evaluating the decision of the French authorities and was committed to working with relevant departments. "Our cookie consent controls give users greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we will continue to develop and improve these controls." In this regard, Google did not respond.

This is not the first time that both companies have been fined for privacy issues. Two years ago, CNIL fined Google 100 million euros for violating French data protection laws. The CNIL said that Google automatically places cookies on web pages and uses them for personalized advertising recommendations without prior notice and consent from users.

In June 2020, the French Council of State announced that it had made a final decision on Google's alleged violation of the European Union's General Data Protection Regulation (GDPR) for personalized advertising: Google had not provided Android users with sufficiently clear and transparent notices to pay a fine of 50 million euros from CNIL.

According to the CNIL investigation, Google violated the GDPR in two places: First, it did not meet the relevant requirements for transparency and information disclosure, such as important provisions such as data use, storage time limit, personal data types required for personalized advertising, etc. scattered in different documents, and sometimes even needed to jump 5 or 6 times to see the whole thing.

The second is the failure to fulfill the obligation to provide a legal basis for personalized advertising, mainly manifested in the fact that users have not been fully informed. In the case of the "Personalized Ads" paragraph, the user does not fully understand from the text that the data processing process may involve other products, such as Google Search, YouTube, Google Maps, etc.

Not long ago, last October, The Irish Data Protection Commission (DPC) proposed to the European Union in a draft decision that Facebook be fined between 28 million and 36 million euros for its lack of clarity and transparency in data processing, and that it be rectified within three months.

Last September, Ireland's Data Protection Commission issued a €225 million fine to WhatsApp. Ireland's Data Protection Commissioner found that WhatsApp violated a number of GDPR regulations by failing to adequately inform how it was processed, its privacy policy and sharing data with its parent company, Facebook (now renamed Meta), and fined it.

Written by: Nandu reporter Sun Chao