Fines follow investigations by the CNIL
The restricted committee considered that this process affects the freedom of consent. This is because, on the Internet, the user expects to be able to quickly consult a website. The fact that they cannot refuse the cookies as easily as they can accept them influences their choice in favour of consent. This constitutes an infringement of Article 82 of the French Data Protection Act.
As a result of this infringement, the CNIL's restricted committee imposed:
In addition to the fines, the restricted committee ordered the companies to provide internet users located in France with a means of refusing cookies as simple as the existing means of accepting them to guarantee their freedom of consent. If the companies fail to do so within three months, they will be required to pay a penalty of 100,000 euros per day of delay.
These two decisions are part of the global compliance strategy initiated by the CNIL over the past two years. They say that French and foreign websites attract many visits but have practices contrary to the legislation on cookies.
Since March 31, 2021, when the CNIL’s deadline set for websites and mobile applications to comply with the new rules on cookies expired, the CNIL has adopted nearly 100 corrective measures (orders and sanctions) related to non-compliance with the legislation on cookies.
This is an interesting case as it is has been brought under the French implementing legislation under the E-Privacy Directive, rather than the GDPR. This means that the one-stop shop does not apply and the French regulator has jurisdiction. If the matter were dealt with under the GDPR, the Irish DPC would have jurisdiction under the one stop shop. Google is now appealing the fine and seeking to have the fine annulled on the grounds that the French CNIL was not competent and should have given the case to the Irish regulator (presumably because they think the Irish regulator would be more lenient and the limit on fines in Ireland under the E-privacy Directive is considerably lower than in France). It remains to be seen whether there is any mileage in Google's argument.