On 7 December 2020, the CNIL's select committee imposed penalties for breaches of the regulations on cookies on :

• GOOGLE LLC and GOOGLE IRELAND LIMITED 100 million fine;
• AMAZON EUROPE CORE for a total fine of 35 million euros.

Between December 2019 and May 2020, the CNIL carried out online checks on the google.fr and amazon.fr websites, revealing three types of breaches of the Data Protection Act:

• Depositing cookies without the user's prior consent

Cookies for advertising purposes were automatically deposited on the user's computer, without any action on their part. This behaviour was not compatible with the obligation to obtain the user's prior consent.

• Failure to inform users

For both sites, no clear and complete information about cookies was provided to the user by the information banner displayed at the foot of the page, nor, for the google.fr site, on the page that appeared when the user clicked on the "Consult now" button.

• On the google.fr site, an advertising cookie remained active even after the mechanism for opposing ad personalisation had been activated.

According to the CNIL, the high penalties imposed are justified not only by the seriousness of the breaches observed, but also by their scope, since they affected millions of consumers and the high profits that they indirectly generated, either via advertising services (for the Google companies) or by considerably increasing the visibility of products marketed by Amazon.

Although the automatic deposit of cookies without consent has since ceased, the new information banners displayed on the google.fr and amazon.fr pages still did not enable users residing in France to understand the purposes for which cookies are used and did not inform them that they could refuse these cookies.

This is why the CNIL has also issued injunctions, subject to a fine, requiring Google and Amazon to provide information to individuals in compliance with the Data Protection Act within 3 months of being notified of its decision. If they fail to do so, they will be liable to pay a penalty of 100,000 euros per day of delay.