France fines Google, Facebook millions over tracking consent

French regulators on Thursday fined Google and Facebook a total of more than 200 million euros ($226 million) for not making it as easy for people to opt-out of online tracking as it is for them to accept it.

The CNIL data privacy watchdog said its investigations found that while the U.S. online giants gave French users a single button to immediately accept cookies, there wasn’t an equally simple way for them to decline because “several clicks are required to refuse all cookies.”

Cookies are snippets of code used to target internet users for digital ads and other purposes. European governments have stricter regulations than the U.S. that require websites to ask for permission before tracking a user’s activity. That means people face pop-up menus when they visit new websites, but there’s been growing concern that many are configured to make it confusing or tedious if they don’t want to give consent.

Visitors to Facebook, Google’s French homepage and YouTube were being nudged to say yes, which meant they weren’t freely giving their consent, a violation of French data protection rules, the CNIL said.

The French watchdog slapped Google with a 150 million euro ($170 million) penalty and Facebook with a 60 million euro ($68 million) fine. It also threatened daily fines of 100,000 euros if they don’t make it simpler for users in France to refuse cookies within three months.

Facebook, which has been renamed Meta, said it’s reviewing the decision and is committed to working with authorities.

“Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls,” the company said.

Google said: “People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision.”

Cookies have been a longstanding source of privacy concerns because they can be employed to track users across the internet. They can be used to help remember someone’s website log-in details or more controversially, to record someone’s web-browsing history to target personalized ads.

The French penalty underscores a broader shift in the digital ad industry as Google and Facebook, which dominate the market, and regulators in Europe and the U.S. work on phasing out more egregious data collection practices. Google has announced plans to phase out so-called third-party cookies used by advertisers from its Chrome browsers, though it will still be able to track users of its own services.