The National Commission on Informatics and Liberty, or CNIL, also ordered Google and Facebook to fix that issue within three months or face daily fines of more than $100,000 from the restricted committee, the CNIL body that handles sanctions, CyberScoop reported.
“The restricted committee considered that this process affects the freedom of consent: since, on the Internet, the user expects to be able to quickly consult a website, the fact that they cannot refuse the cookies as easily as they can accept them influences their choice in favor of consent,” the CNIL wrote.
That puts the two companies in violation of the French Data Protection Act, the commission said. On Facebook, YouTube and Google sites, one click can enable cookies but it takes multiple clicks to refuse them all, the CNIL said.
While cookies are largely a matter of privacy and convenience, criminals can hijack them to spy on users.
Google’s cookie policies has earned millions in CNIL fines before, as well as Amazon. Overall, the agency has issued nearly 100 orders and sanctions since the end of March, “when the deadline set for websites and mobile applications to comply with the new rules on cookies expired.”
Both Google and Facebook issued statements vowing to work with French authorities to sort the issue, though the latter firm insisted its “cookie consent controls provide people with greater control over their data,” disputing the consent issues raised by the CNIL.
Google, too, argued that “people trust us to respect their right to privacy and keep them safe,” but nonetheless said it would pursue “further changes” to comply with the order.