France fines Google and Facebook €210m over user tracking

Internet users' prior consent for the use of cookies is a key pillar of the EU's data privacy regulation, and a top priority for the CNIL.

"When you accept cookies, it's done in just one click," said Karin Kiefer, CNIL's head of data protection and sanctions. "Rejecting cookies should be as easy as accepting them."

The watchdog said the facebook.com, google.fr and youtube.com websites did not allow the easy refusal of cookies. Citing the example of Facebook, it said: "Several clicks are required to refuse all cookies, as opposed to a single one to accept them."

A Google spokesperson said: "People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision."

In 2020, the CNIL strengthened consent rights over ad trackers, saying websites operating in France should keep a register of internet users' refusal to accept cookies for at least six months.

It also said internet users should be able to easily reconsider any initial agreement concerning cookies via a weblink or an icon that should be visible on all pages of a website.