CNIL closes Google cookies enforcement after SAN-2021-023 compliance
Status Not cited by any decision here yet
Original title: CNIL (France) - SAN-2023-012
Holding
The French DPA held that Google's updated cookie system was compliant, as the implementation of the "reject all" button offered a means of users refusing the storage of and access to their information, pursuant to Article 82 French Data Protection Act. Consequently, the French DPA decided to dismiss the periodic fine of €100,000 per day in the case of non-compliance, as the updated cookie banner was lawful.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
Full text 10 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
Deliberation of the restricted panel no. SAN-2023-12 of July 13, 2023 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation no. SAN-2021-023 of December 31, 2021 The National Commission for Information Technology and Freedoms, gathered in its restricted formation composed of Mr. Philippe-Pierre CABOURDIN, vice-president, Mrs. Anne DEBET and Christine MAUGÜÉ, and Messrs. Alain DRU and Bertrand du MARAIS, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to law n° 78-17 of January 6, 1978 as amended relating to data processing, files and freedoms, in particular its articles 20 et seq.; Having regard to Decree No. 2019-536 of May 29, 2019 as amended taken for the application of Law No. 78-17 of January 6, 1978 relating to computing, files and freedoms; Having regard to deliberation no. 2013-175 of July 4, 2013 adopting the internal regulations of the National Commission for Information Technology and Liberties; Having regard to deliberation no. SAN-2021-023 of December 31, 2021 adopted by the restricted panel against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Having regard to the elements transmitted by the companies GOOGLE LLC and GOOLE IRELAND LIMITED on April 4, April 19, May 25 and June 15, 2022, to demonstrate their compliance with the injunction; Having regard to the letter of August 5, 2022, by which the president of the restricted panel asked the rapporteur to intervene again in the procedure for the purpose of examining these elements; Having regard to the additional request from Ms. Valérie PEUGEOT, commissioner rapporteur, notified to the boards of the companies GOOGLE LLC and GOOGLE IRELAND LIMITED on January 25, 2023; Having regard to the letter dated April 28, 2023, in response to the additional request, sent by the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the other documents in the file; After deliberating at the meeting of July 13, 2023, adopted the following decision: I. FACTS AND PROCEDURE
Decision no SAN-2021-023 of December 31, 2021, notified to the company GOOGLE LLC on January 14, 2022 and on January 17, 2022 to the company GOOGLE IRELAND LIMITED, ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED (hereinafter after “Google”) of: "to modify, on the websites "google.fr" and "youtube.com", the terms of obtaining the consent of users located in France to the operations of reading and/or writing information in their terminal, by offering a means of refusing these operations presenting a simplicity equivalent to the mechanism provided for their acceptance, in order to guarantee the freedom of their consent".
This injunction was accompanied by a penalty of one hundred thousand euros (100,000) euros per day of delay at the end of a period of three months following notification of the deliberation of the restricted formation, the supporting documents for the in compliance must be sent to the restricted training within this deadline.
On April 4, 2022, within the deadline set by the deliberation, Google sent the president of the restricted training elements with a view to justifying its compliance, presenting the measures that it intended to implement from mid -April 2022 on YouTube and at the end of April or in the first weeks of May 2022 for Google Search. The modifications consisted of adapting the user journey so that the pop-up windows relating to cookies, which appear when the user goes to the companies' websites, now include a refusal button entitled "Refuse all".
On April 19, May 25 and June 15, 2022, Google sent to the president of the restricted training the supporting documents attesting to the deployment on the websites "google.fr" and "youtube.com" of these new pop-up windows relating to cookies .
By letter dated August 5, 2022, the president of the restricted panel asked the rapporteur to intervene again for the purposes of examining these elements, on the basis of article 44 of decree no. 2019-536 of May 29, 2019, to ensure the effectiveness of the refusal mechanism implemented by the company.
For this purpose, after an analysis notified to Google on January 25, 2023, the rapporteur asked Google to provide her, within 2 months, with additional information.
By letter dated April 28, 2023, Google provided the requested details. II. REASONS FOR DECISION
The restricted training notes that it appears from the elements provided by the company in its various letters that people visiting the websites "google.fr" and "youtube.com" are now offered a means of refusing operations reading and/or writing information in their terminal presenting a simplicity equivalent to the mechanism provided for their acceptance.
The proposed terms make it possible to guarantee the freedom of user consent, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have complied with the injunction within the allotted time limit. FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - to say that there is no need to liquidate the penalty; - to make public, on the CNIL website and on the Légifrance website, this deliberation which will no longer identify the companies by name at the end of a period of two years, the starting point being the publication of the deliberation no. SAN-2021-023 of December 31, 2021. The vice president Philippe-Pierre CABOURDIN