France’s data protection authority on Wednesday issued record fines against search giant Google and fast-fashion platform Shein for failing to respect the law on internet cookies.
The two groups, each with tens of millions of users in France, received two of the heaviest penalties ever imposed by the CNIL watchdog: 150 million euros ($175 million) for Shein and 325 million euros for Google.
Both firms failed to secure users’ free and informed consent before setting advertising cookies on their browsers, the authority found in a decision the companies can still appeal.
Cookies are small files saved to browsers by websites that can collect data about users’ online activity, making them essential to online advertising and the business models of many large platforms.
The CNIL has stepped up its scrutiny of their use, part of “a general strategy of bringing (market players) into line over the past five years, targeting especially sites and services that receive a lot of traffic,” the authority said.
Shein had amassed “massive” amounts of data from the cookies it placed on 12 million monthly users’ computers in France, it added.
The Asian low-cost clothing firm failed to secure users’ consent or inform them adequately, as well as offering inadequate options to withdraw consent.
Shein has updated its systems to comply with the CNIL’s requirements under French and European law since the investigation.
It told AFP that it would appeal the fine, which it said was “totally disproportionate given the nature of the alleged grievances” and its “current compliance” with the legislation.
Google said it would study the decision, and that it has complied with earlier CNIL demands.
– ‘Cookie wall’ –
Wednesday’s fine against Google is the third issued by the CNIL over the search giant’s use of cookies, after paying 100 million euros in 2020 and 150 million in 2021.
Prosecutors had requested an even heavier penalty this time, of 520 million euros.
Authorities have justified the size of the punishments with reference to the sheer number of Google users in France and the broad array of “negligence” the CNIL says it is guilty of.
They especially highlight the case of a so-called “cookie wall” when creating a Google account, which requires users to accept the tracking software before proceeding.
While not in itself illegal, the implications were not sufficiently explained to users, who could therefore not provide informed consent, the CNIL found.
Some 53 million French people were also affected by Google’s practice of inserting adverts between inbox items in its popular Gmail email service.
Such “direct canvassing” of users requires prior consent by users under European legal precedent, which Google did not secure according to the CNIL.
On top of the fines, Google has been ordered to bring its systems into compliance within six months.
Failure to comply would draw further penalties of 100,000 euros per day for both Google and its Irish subsidiary.
