From 12 December 2019 to 19 May 2020, French data privacy watchdog CNIL conducted an investigation into amazon.fr, Amazon’s French marketplace website.
The investigation concluded that amazon.fr was placing cookies on a user’s computer without knowledge or action required by the user to approve the cookies which were then used for advertising purposes and fined the company 35 million Euros ($42 million).
Under French regulations, the CNIL said that this type of tracking cookie, which is not essential to the service, can only be placed after a user provides expressed consent. It further stated that the information banner displayed to a visitor at amazon.fr was neither clear, nor complete.
Furthermore, it said users could not understand that cookies placed on a visitor’s computer were mainly used to display personalized ads. It also noted that the banner did not explain to the user that it could refuse these cookies and how to do it.
While Amazon redesigned the amazon.fr website not to place cookies on a user’s computer before the user consents to use of such cookies, CNIL says the company still does not provide sufficient information to users living in France that the cookies are main use is for advertising purposes and that the user can refuse the cookies.
In addition to the fine, CNIL ordered Amazon to adequately inform individuals within three months in accordance with Article 82 of the French Data Protection Act or face an additional 100,000 Euro fine per day.
In a separate release, CNIL announced that Google was also fined 100 million Euros ($121 million) by the CNIL over how it manages cookies and given the same three months ultimatum to remedy the problem.
In a statement to Bloomberg, both companies disagreed with the conclusions of the CNIL investigations. Amazon said, “We continuously update our privacy practices to ensure that we meet the evolving needs and expectations of customers and regulators and fully comply with all applicable laws in every country in which we operate.”
Google added, “[it has a] record of providing upfront information and clear controls, strong internal data governance, secure infrastructure, and above all, helpful products.” Moreover, Google criticized the French watchdog by saying, “[the CNIL] overlooks these efforts and doesn’t account for the fact that French rules and regulatory guidance are uncertain and constantly evolving.”