Tech giants Facebook Ireland and the French arm of Google have been hit with huge fines in France for their non-compliance with legislation over cookies on their websites.

Google has been asked to pay €150 million (£125m), while Facebook will have to hand over €60m (£50) for making it difficult for internet users to refuse online trackers known as cookies.

The CNIL said that despite firms offering a button allowing the user to immediately accept cookies, they do not provide an equivalent solution to refuse the deposit cookies.

The regulator noted that “several clicks” were required by internet users to refuse all cookies, compared to a single click to accept them. This process, the CNIL said, affects “the freedom of consent” of users.

“Since, on the Internet, the user expects to be able to quickly consult a website, the fact that they cannot refuse the cookies as easily as they can accept them influences their choice in favour of consent. This constitutes an infringement of Article 82 of the French Data Protection Act,” the CNIL said in a release.

As well as the fines, the companies should expect fundamental changes to their cookie policies and provide internet users with a one-click option to refuse cookies in order to guarantee their freedom of consent.

If Google and Facebook fail to comply with the orders within the next within three months, they will be expected to pay a penalty of €100,000 per day of delay, the CNIL said.

In a statement to IT Pro, a Facebook spokesperson said the firm was “reviewing the authority’s decision” and remained “committed to working with relevant authorities.”

A Google spokesperson said: “We understand our responsibility to protect that trust and are committing to further changes and active work with the the CNIL in light of this decision under the ePrivacy Directive.”

Prior cookies consent is a key part of the EU’s data privacy regulation and a top priority for the the CNIL.

Alan Calder, CEO of IT governance, risk management and compliance solutions provider GRC International Group, commented: “The reluctance of big US Tech corporations to comply with the EU Cookie Laws, combined with the apparently easy-going nature of the Irish DPC, has led the CNIL to take action under the ePrivacy Directive.

“The ePrivacy Directive still allows national action against breaches and is not currently subject to the same ‘lead regulator’ arrangements that apply to GDPR actions.”

Recommended

• Leader Insights | Scottish startups need to scale up, not sell out
• In a world first, a drone helped save the life of a cardiac arrest patient
• Openreach finds recruitment language boosts female roles

This is not the first time that both Google and Facebook have been hit with fines by regulators.

In December last year, the CNIL fined Google  €100m (£91m) over its use of advertising tracking cookies.

The CNIL said the company deployed tracking cookies automatically without user consent whenever they visited the companies’ French domains, which violates the country’s Data Protection Act.

In 2018, the Information Commissioner’s Office in the UK fined Facebook £500k for failing to protect users’ personal information as part of the Cambridge Analytica scandal.

GDPR fines rose exponentially over the last few years, according to data collected by Atlas VPN. Fines hit over €1 billion in 2021 – compared to €171 million in 2020.

A total of 412 penalties were issued last year, with companies like Amazon and WhatsApp paying the most significant penalties for violating GDPR laws, Atlas said.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

We will keep you up to date on the pivotal issues impacting the sector and let you know about key upcoming events to ensure that you don’t miss out on what’s going on across the Scottish tech community.

Click here to subscribe.