France fines Google, Amazon €135m total for slipping ad cookies into people's computers without permission
- Reference: 1607670373
- News link: https://www.theregister.co.uk/2020/12/11/amazon_google_french_fines/
- Source link:
The National Commission on Informatics and Liberty (CNIL) announced on Thursday that both internet goliaths had secretly slipped cookies on users' computers whenever they accessed the [1]Amazon’s e-commerce bazaar and [2]Google’s search engine in France. Under the French Data Protection Act, companies must obtain explicit consent to deploy cookies that enable targeted adverts personalised for individual netizens.
Google and Amazon, however, automatically placed the web cookies without people knowing, we're told. CNIL also said they failed to provide clear explanations disclosing what the cookies were being used for and how users could opt-out, beyond generic messages, specifically Amazon’s “By using this website, you accept our use of cookies allowing us to offer and improve our services,” and Google’s “Privacy reminder from Google” with two buttons labeled “Remind me later” and “Access now”.
French data watchdog dishes out largest GDPR fine yet: Google ordered to hand over €50m [3]READ MORE
The Chocolate Factory, however, has been accused of breaking a third rule. Although people could deactivate personalized ads, Google continued to store one of its advertising cookies nonetheless, it is said.
CNIL investigated both super-giants for months in 2019, and noted that they have both improved their practices since. Google stopped surreptitiously slipping cookies into the PCs of French users when it updated its site in September, and Amazon has improved customer notifications of its cookie policy in line with the law.
The Google €100m ($121m, £91m) will be split with €60m ($73m, £55m) to be paid by Google and €40m ($49m, £37m) by its subsidiary Google Ireland. Amazon Europe Core in Luxembourg is expected to pay the €35m ($55m or £41m). Both corporations bank billions a year in profit, mind.
“The restricted committee justified these amounts having regard to the seriousness of the breach of Article 82 of the French Data Protection Act, that has been observed in relation with three aspects,” it [4]said in a statement about Google.
“It also highlighted the scope of the search engine Google Search in France and the fact that the practices of the companies affected almost fifty million users.”
An Amazon spokesperson told The Register : “We disagree with the CNIL’s decision. Protecting the privacy of our customers has always been a top priority for Amazon. We continuously update our privacy practices to ensure that we meet the evolving needs and expectations of customers and regulators and fully comply with all applicable laws in every country in which we operate.”
We’re still waiting to hear back from Google. ®
Get our [5]Tech Resources
[1] https://www.cnil.fr/en/cookies-financial-penalty-35-million-euros-imposed-company-amazon-europe-core
[2] https://www.cnil.fr/en/cookies-financial-penalties-60-million-euros-against-company-google-llc-and-40-million-euros-google-ireland
[3] https://www.theregister.com/2019/01/21/google_50m_cnil_gdpr/
[4] https://www.cnil.fr/en/cookies-financial-penalties-60-million-euros-against-company-google-llc-and-40-million-euros-google-ireland
[5] https://whitepapers.theregister.com/
Block them. Delete them.
Use an ad tracker/blocker and a program like ccleaner on your PC. As for mobile devices, I always use a browser and add/tracker blocker instead of dedicated apps where possible and delete cookies often. I’m sure this probably doesn’t go far enough but it’s at least something to try to combat the annoying cookie infestation.
Re: Block them. Delete them.
It's OK using trackers and blockers if you understand them - and even then it can be a pain in the neck Lots of sites don't work properly - or at all - even with Firefoxes enhanced tracking protection, never mind ad and script blockers. Whenever I go home and look at my mum's PC I don't know how she puts up with it, but if I installed any blockers she'd have to call me every day to fix inaccessible sites.
Google et al won't stop doing this until there are real sanctions - like jail time.
Re: Block them. Delete them.
As I said, at least it’s something and I’m aware it isn’t enough. I understand blockers can disrupt site operability which is a huge pain. I, at least, seem to be doing OK with these settings.
Yes we need proper sanctions but until (if ever) that happens, blocking and deleting ads and cookies is really all we have, whether you’re tech savvy enough to use them or not.
Amazon and Google etc, value their customers the way a farmer values ears of wheat; they care about and nurture it enough that they can harvest it and make a profit.
In fact a farmer probably cares a great deal more.
Farmers
You could say the same about Cannibals
Re: Farmers
Not really, no. Since when do cannibals raise a human heard to cull at their convenience?
Privacy fines should be based on the number of users declared on financial statements
So they can decide to be fined for false financial statements or for breaking privacy... in both cases fines should have a real impact on companies breaking the rules.
Re: Privacy fines should be based on the number of users declared on financial statements
I think that they are... €135m is not exactly spare change. However, it's also related to the severity of infringement; in this case the problem is that they are telling people about the cookies, but the explanations are "not clear enough". Considering nobody reads the explanations anyway, I'd say this is hardly the stuff of high treason.
"C.j." Bezos here ..
Kindly allocate the last 2 seconds of profit to paying that fine would you.
Two words...
"Not enough"
As someone else has put, 135m euro is down-the-back-of-the-couch change for these guys. If there are going to be fines, they have to actually have an impact.
Re: Two words...
An objective assessment of the revenue raised by these breaches of cookie laws would have been useful. Whatever that turns out to be, triple it for the fine. Objective assessment, not the company's own assessment. That will require legal authority to subpoena all relevant details, with extremly heavy penalties and executive jail time for non-compliance.
The penalty cost must greatly exceed the gains from breaking the rules, otherwise fines are (yet again) just another cost of doing business.
Amazon: " Protecting the privacy of our customers has always been a top priority for Amazon. "
Yes, there's 'protecting' the privacy of your users. This, however, is about 'respecting' the privacy of users.... you're doing it wrong.