Advertising cookies: CNIL imposes colossal fines on Google and Shein

These trackers, essential to the online advertising sector and integrated into the economic model of many platforms, have been subject to increased control by the French authorities for several years.

The two groups, whose services are used by tens of millions of French people, received the two largest sanctions ever imposed by the CNIL - with the exception of a fine of 150 million targeting Google in 2022, also concerning cookies.

Google, also fined for advertising violations, was fined €325 million. Shein Group will have to pay €150 million.

The Asian discount clothing giant announced to AFP that it would appeal to the Council of State and the Court of Justice of the European Union, deeming the fine "totally disproportionate given the nature of the alleged grievances" and its "current compliance" with the legislation, a severity it attributes to "political considerations."

"We are studying the content of the decision," reacted a Google spokesperson, maintaining that "users have always had the possibility of controlling the advertisements they see in our products" and that updates have been made "in order to address the concerns of the CNIL."

Both companies failed to meet their obligations to obtain the free and informed consent of Internet users before collecting advertising cookies. These cookies, which track Internet users' online activity for targeted advertising, are strictly regulated by law.

The two fines announced Wednesday are part of the overall compliance strategy initiated by the CNIL over five years ago regarding trackers, which particularly targets players in high-traffic sites and services, the French National Commission for Information Technology and Civil Liberties (CNIL) stressed.

In the case of Shein, the authority points to the "massive nature" of the data concerned, with 12 million monthly users of the site in France.

The CNIL criticizes the company for not obtaining user consent for certain cookies, but also for a lack of information for Internet users, as well as a faulty consent withdrawal mechanism.

Shein has nevertheless complied with the CNIL's requirements since the inspections.

- "Neglect" -

Google, for its part, has been targeted for the third time by a CNIL sanction regarding cookies. In one of its press releases published Wednesday, the authority highlighted the group's "negligence," which was hit in 2020 with a €100 million fine, then in 2021 with a new €150 million fine.

But the amount of the new sanction decided against the American giant - although lower than the requested fine of 525 million euros - is also justified by the number of users concerned, and the plurality of breaches.

The authority thus looked into the company's implementation of a "cookie wall" when creating a Google account.

This practice, which makes Internet users' access conditional on the acceptance of cookies, is not illegal in the company's case, the CNIL ruled, but it is subject to the informed consent of users. This condition was not met due to the lack of information provided to Internet users.

At the same time, Google is also being targeted for inserting advertising banners between emails in its Gmail inbox for some users who opted for "smart features." The practice affected 53 million French people, according to the CNIL.

These advertisements, which "constitute direct prospecting" according to European case law, should have been subject to prior consent from users, which was not the case.

The fine was combined with an injunction to stop the violations within six months. After that, Google and its Irish subsidiary will each have to pay penalties of €100,000 per day.

Shein and Google have four months to appeal the sanction decision before the administrative court.