SAN-2023-012
This decision follows from a previous decision of the French DPA (SAN 2021-023 of 31 December 2021), in which said DPA fined Google LLC €90,000,000 and Google Ireland Limited €60,000,000 for violating Article 82 French Data Protection Act. This Act transposes the ePrivacy Directive into domestic French law. Article 82 of the French Data Protection Act is the national equivalent to Article 5(3) ePrivacy Directive 2002/58/EC, which stipulates that the storing of user information or the gaining of access to information already stored, is only permitted on the condition that the user has already given their informed consent. The French DPA had fined Google LLC and Google Ireland Limited in decision SAN 2021-023 for failing to offer users a way of rejecting cookies. It ordered Google to bring its processing activities into compliance and imposed an additional periodic fine of €100,000 per day if Google failed to bring its processing activities into compliance within 3 months. On 24 April 2022, Google sent the French DPA its proposed cookie amendments, which included a button titled "reject all." Between April and June 2022, Google sent further information to the French DPA, and on 5 August 2022, the French DPA re-investigated the matter to ensure that the updated cookie system was compliant. On 25 January 2023 the French DPA requested further information from Google on their system, which Google provided on 28 April 2023. Holding — The French DPA held that Google's updated cookie system was compliant, as the implementation of the "reject all" button offered a means of users refusing the storage of and access to their information, pursuant to Article 82 French Data Protection Act. Consequently, the French DPA decided to dismiss the periodic fine of €100,000 per day in the case of non-compliance, as the updated cookie banner was lawful.
How it connects
Related across sources
Full text 9 findings
Decision no SAN-2021-023 of December 31, 2021, notified to the company GOOGLE LLC on January 14, 2022 and on January 17, 2022 to the company GOOGLE IRELAND LIMITED, ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED (hereinafter after “Google”) of: "to modify, on the websites "google.fr" and "youtube.com", the terms of obtaining the consent of users located in France to the operations of reading and/or writing information in their terminal, by offering a means of refusing these operations presenting a simplicity equivalent to the mechanism provided for their acceptance, in order to guarantee the freedom of their consent".
This injunction was accompanied by a penalty of one hundred thousand euros (100,000) euros per day of delay at the end of a period of three months following notification of the deliberation of the restricted formation, the supporting documents for the in compliance must be sent to the restricted training within this deadline.
On April 4, 2022, within the deadline set by the deliberation, Google sent the president of the restricted training elements with a view to justifying its compliance, presenting the measures that it intended to implement from mid -April 2022 on YouTube and at the end of April or in the first weeks of May 2022 for Google Search. The modifications consisted of adapting the user journey so that the pop-up windows relating to cookies, which appear when the user goes to the companies' websites, now include a refusal button entitled "Refuse all".
On April 19, May 25 and June 15, 2022, Google sent to the president of the restricted training the supporting documents attesting to the deployment on the websites "google.fr" and "youtube.com" of these new pop-up windows relating to cookies .
By letter dated August 5, 2022, the president of the restricted panel asked the rapporteur to intervene again for the purposes of examining these elements, on the basis of article 44 of decree no. 2019-536 of May 29, 2019, to ensure the effectiveness of the refusal mechanism implemented by the company.
For this purpose, after an analysis notified to Google on January 25, 2023, the rapporteur asked Google to provide her, within 2 months, with additional information.
By letter dated April 28, 2023, Google provided the requested details. II. REASONS FOR DECISION
The restricted training notes that it appears from the elements provided by the company in its various letters that people visiting the websites "google.fr" and "youtube.com" are now offered a means of refusing operations reading and/or writing information in their terminal presenting a simplicity equivalent to the mechanism provided for their acceptance.
The proposed terms make it possible to guarantee the freedom of user consent, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have complied with the injunction within the allotted time limit. FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - to say that there is no need to liquidate the penalty; - to make public, on the CNIL website and on the Légifrance website, this deliberation which will no longer identify the companies by name at the end of a period of two years, the starting point being the publication of the deliberation no. SAN-2021-023 of December 31, 2021. The vice president Philippe-Pierre CABOURDIN