The French data protection authority ('CNIL') announced, on 10 December 2020, its deliberation imposing on Amazon Europe Core Sarl a fine of €35 million for cookie violations under Article 82 of the Act No.78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (as amended to implement the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR')). In particular, the Restricted Committee of CNIL highlighted that after conducting investigations from 12 December 2019 to 19 May 2019 on the website amazon.fr, it found that when a user visited the website, cookies were placed automatically on their computer in the absence of any action by the user. In regards to this automatic placement of cookies, CNIL found that such placement of cookies at the time the user entered the website was incompatible with the requirement to obtain the user's prior consent. In addition, CNIL noted that the use of browser settings as a valid mechanism for collecting consent depends on the user being informed that they have a possibility to consent through browser settings beforehand, which had not happened in the case of Amazon's website.

Moreover, CNIL found that there was insufficient information provided to users upon entering the Amazon website as the information banner stated that by using the website, users accept the use of cookies, and so found that the user could not understand that cookies placed on their device would be used for displaying personalised ads. Lastly, CNIL considered that, through the banner, the users had not received adequate information on their ability to object to the use of cookies and that, therefore, Amazon had not complied with its obligation to adequately inform users about the use of cookies for advertisement purposes.

On the basis of the above and considering that Amazon's cookie practices had taken place for a long time, as well as the fact that the Amazon website is accessed by millions of people who are subject to the storage of cookies on their website, the Restricted Committee fined Amazon €35 million. In addition, it ordered Amazon to adequately inform individuals about the use of cookies within three months after receiving the notification of the deliberation.

CNIL has also announced two fines totalling €100 million against Google LLC and Google Ireland Limited for cookie violations.

You can read the press release here and the deliberation, only available in French, here.