{"id":1844,"date":"2022-02-21T15:48:38","date_gmt":"2022-02-21T19:48:38","guid":{"rendered":"http:\/\/ielrblog.com\/?p=1844"},"modified":"2022-02-21T15:48:38","modified_gmt":"2022-02-21T19:48:38","slug":"frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations","status":"publish","type":"post","link":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/","title":{"rendered":"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations"},"content":{"rendered":"

By Jonathan J. Rusch[1]<\/a><\/p>\n

It should be no surprise to any company doing business in the European Union that if it wants to use \u201ccookies\u201d \u2013 small text files stored in an Internet user\u2019s computer to identify that user — for advertising purposes, it must abide by the provisions of EU law pertaining to data privacy.\u00a0 Recitals 26 and 28 of the General Data Protection Regulation (GDPR) make clear<\/a> that any data that can be used to identify an individual either directly or indirectly is considered personal data.\u00a0 Moreover, for more than a decade the EU E-privacy Directive has recognized<\/a> that users have a right to refuse cookies when an entity\u2019s website seeks to place cookies on the users\u2019 computers.<\/p>\n

Even so, in 2020 the French Data Protection Authority (CNIL) imposed<\/a> a total of \u20ac100 million on fines on a world-leading technology company, Google, for failure to comply with the obligation to obtain users’ consent before it installed advertising cookies or other tracking devices.\u00a0\u00a0 The CNIL did so pursuant to Article 82 of the French Data Protection Act, which transposes the E-privacy Directive.\u00a0 Google then appealed to the French Conseil d\u2019\u00c9tat, the highest French court<\/a> for cases involving public administration, in an effort to annul the fines.<\/p>\n

On February 1, the Conseil d\u2019\u00c9tat rejected<\/a> Google\u2019s position and affirmed the CNIL fines.\u00a0 In its decision<\/a>, the Conseil d’Etat confirmed that the CNIL had the power to intervene as it did.\u00a0 It also found that Google had failed to provide users with clear and complete information or to obtain their prior consent to cookie placement, and had a defective cookie refusal procedure.\u00a0 The Conseil took note of the fact that an audit that the CNIL conducted in March 2020 disclosed \u201cthat seven cookies were automatically installed on users’ computers as soon as they visited the site, four of which were only used for advertising purposes.\u201d \u00a0During that audit procedure, Google \u201cmodified its practices in August 2020, but continued not to inform the user directly and explicitly about the purposes of its cookies and the means of objecting to them.\u201d<\/p>\n

The Conseil further noted<\/a> that the amount of the fines that the CNIL imposed did not exceed the limit set by the French Data Protection Act, and that the fines were not disproportionate in view of the significant profits generated by the data collected through advertising cookies, and of Google’s dominant market share in France (more than 90 percent, which equates to approximately 47 million users).<\/p>\n

Google reportedly<\/a> is already looking ahead to replacing its advertising cookies with \u201ca new system called Topics, in which advertisers will place ads via a limited number of topics determined by users’ browser activity.\u201d\u00a0 At other firms doing business in the EU, however, Chief Privacy Officers and Chief Compliance Officers should take note of the Conseil d\u2019\u00c9tat decision and compare the Conseil\u2019s findings against their own cookie policies and practices.\u00a0 Although certain aspects of data-protection law can be exceptionally complex<\/a>, providing clear guidance to internet users about prior consent to or refusal of cookies should not be.<\/p>\n

[1]<\/a>\u00a0\u00a0 Jonathan J. Rusch is Adjunct Professor and Co-Director of the U.S. and International Anti-Corruption Law Program at American University Washington College of Law and Adjunct Professor at Georgetown University Law Center.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Jonathan J. Rusch[1] It should be no surprise to any company doing business in the European Union that if it wants to use \u201ccookies\u201d \u2013 small text files stored in an Internet user\u2019s computer to identify that user — for advertising purposes, it must abide by the provisions of EU law pertaining to data […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[13,247,33,14,70,93],"tags":[292,290,156,289,288,291],"class_list":{"0":"post-1844","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-international-administrative-penal-law","7":"category-comparativecriminallaw","8":"category-cybercrime","9":"category-data-privacy","10":"category-economicintegration","11":"category-human-rights","12":"tag-cookies","13":"tag-conseil-detat","14":"tag-european-union","15":"tag-french-data-protection-act","16":"tag-general-data-protection-regulation-gdpr","17":"tag-google","18":"entry"},"yoast_head":"\nFrance\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations | IELR Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations | IELR Blog\" \/>\n<meta property=\"og:description\" content=\"By Jonathan J. Rusch[1] It should be no surprise to any company doing business in the European Union that if it wants to use \u201ccookies\u201d \u2013 small text files stored in an Internet user\u2019s computer to identify that user — for advertising purposes, it must abide by the provisions of EU law pertaining to data […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/\" \/>\n<meta property=\"og:site_name\" content=\"IELR Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/m.facebook.com\/intlenforcementlawreporter\/?ref=bookmarks\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-21T19:48:38+00:00\" \/>\n<meta name=\"author\" content=\"Bruce Zagaris\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ielr\" \/>\n<meta name=\"twitter:site\" content=\"@ielr\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bruce Zagaris\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/\"},\"author\":{\"name\":\"Bruce Zagaris\",\"@id\":\"https:\\\/\\\/ielrblog.com\\\/#\\\/schema\\\/person\\\/e491a7e89d418cb82a8c67687806ab66\"},\"headline\":\"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations\",\"datePublished\":\"2022-02-21T19:48:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/\"},\"wordCount\":554,\"commentCount\":0,\"keywords\":[\"\u201ccookies\u201d\",\"Conseil d\u2019\u00c9tat\",\"European Union\",\"French Data Protection Act\",\"General Data Protection Regulation (GDPR\",\"Google\"],\"articleSection\":[\"Administrative Penal Law\",\"comparativecriminallaw\",\"cybercrime\",\"Data Privacy\",\"economicintegration\",\"Human Rights\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/\",\"url\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/\",\"name\":\"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations | IELR Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ielrblog.com\\\/#website\"},\"datePublished\":\"2022-02-21T19:48:38+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/ielrblog.com\\\/#\\\/schema\\\/person\\\/e491a7e89d418cb82a8c67687806ab66\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/2022\\\/02\\\/21\\\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/ielrblog.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ielrblog.com\\\/#website\",\"url\":\"https:\\\/\\\/ielrblog.com\\\/\",\"name\":\"IELR Blog\",\"description\":\"Official Blog of the International Enforcement Law Reporter\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ielrblog.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ielrblog.com\\\/#\\\/schema\\\/person\\\/e491a7e89d418cb82a8c67687806ab66\",\"name\":\"Bruce Zagaris\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5b88b62733380c051d9ae8ffa877632a9180505d62fe9bcec138e2038ecdcd51?s=96&d=monsterid&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5b88b62733380c051d9ae8ffa877632a9180505d62fe9bcec138e2038ecdcd51?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5b88b62733380c051d9ae8ffa877632a9180505d62fe9bcec138e2038ecdcd51?s=96&d=monsterid&r=g\",\"caption\":\"Bruce Zagaris\"},\"url\":\"https:\\\/\\\/ielrblog.com\\\/index.php\\\/author\\\/ielrblogadmin1\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations | IELR Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/","og_locale":"en_US","og_type":"article","og_title":"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations | IELR Blog","og_description":"By Jonathan J. Rusch[1] It should be no surprise to any company doing business in the European Union that if it wants to use \u201ccookies\u201d \u2013 small text files stored in an Internet user\u2019s computer to identify that user — for advertising purposes, it must abide by the provisions of EU law pertaining to data […]","og_url":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/","og_site_name":"IELR Blog","article_publisher":"https:\/\/m.facebook.com\/intlenforcementlawreporter\/?ref=bookmarks","article_published_time":"2022-02-21T19:48:38+00:00","author":"Bruce Zagaris","twitter_card":"summary_large_image","twitter_creator":"@ielr","twitter_site":"@ielr","twitter_misc":{"Written by":"Bruce Zagaris","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/#article","isPartOf":{"@id":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/"},"author":{"name":"Bruce Zagaris","@id":"https:\/\/ielrblog.com\/#\/schema\/person\/e491a7e89d418cb82a8c67687806ab66"},"headline":"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations","datePublished":"2022-02-21T19:48:38+00:00","mainEntityOfPage":{"@id":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/"},"wordCount":554,"commentCount":0,"keywords":["\u201ccookies\u201d","Conseil d\u2019\u00c9tat","European Union","French Data Protection Act","General Data Protection Regulation (GDPR","Google"],"articleSection":["Administrative Penal Law","comparativecriminallaw","cybercrime","Data Privacy","economicintegration","Human Rights"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/","url":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/","name":"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations | IELR Blog","isPartOf":{"@id":"https:\/\/ielrblog.com\/#website"},"datePublished":"2022-02-21T19:48:38+00:00","author":{"@id":"https:\/\/ielrblog.com\/#\/schema\/person\/e491a7e89d418cb82a8c67687806ab66"},"breadcrumb":{"@id":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ielrblog.com\/index.php\/2022\/02\/21\/frances-conseil-detat-upholds-e100-million-fine-against-google-for-advertising-cookie-related-data-protection-violations\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ielrblog.com\/"},{"@type":"ListItem","position":2,"name":"France\u2019s Conseil d\u2019Etat Upholds \u20ac100 Million Fine Against Google for Advertising Cookie-Related Data Protection Violations"}]},{"@type":"WebSite","@id":"https:\/\/ielrblog.com\/#website","url":"https:\/\/ielrblog.com\/","name":"IELR Blog","description":"Official Blog of the International Enforcement Law Reporter","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ielrblog.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ielrblog.com\/#\/schema\/person\/e491a7e89d418cb82a8c67687806ab66","name":"Bruce Zagaris","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5b88b62733380c051d9ae8ffa877632a9180505d62fe9bcec138e2038ecdcd51?s=96&d=monsterid&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5b88b62733380c051d9ae8ffa877632a9180505d62fe9bcec138e2038ecdcd51?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5b88b62733380c051d9ae8ffa877632a9180505d62fe9bcec138e2038ecdcd51?s=96&d=monsterid&r=g","caption":"Bruce Zagaris"},"url":"https:\/\/ielrblog.com\/index.php\/author\/ielrblogadmin1\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pas6ng-tK","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/posts\/1844","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/comments?post=1844"}],"version-history":[{"count":1,"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/posts\/1844\/revisions"}],"predecessor-version":[{"id":1845,"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/posts\/1844\/revisions\/1845"}],"wp:attachment":[{"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/media?parent=1844"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/categories?post=1844"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ielrblog.com\/index.php\/wp-json\/wp\/v2\/tags?post=1844"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}