info@edpo.com
Fine of 100M euros for Google
FRENCH DATA PROTECTION AUTHORITY – NEWS
https://www.cnil.fr/fr/cookies-sanction-de-60-millions-deuros-lencontre-de-google-llc-et-de-40-millions-deuros-lencontre-de
Cookies: €60 million fine against GOOGLE LLC and €40 million fine against GOOGLE IRELAND LIMITED
10 December 2020
On March 16, 2020, the CNIL carried out an online check on the website google.fr which revealed that when a user visited the website, cookies were automatically placed on their computer, without any action on their part. Several of these cookies had an advertising objective.
Breaches of the Data Protection Act
The Restricted Committee, the CNIL body in charge of pronouncing sanctions, found three violations of Article 82 of the French Data Protection Act:
Placing of cookies without prior collection of the user’s consent
When a user visited the google.fr website, several cookies with an advertising purpose were automatically placed on the user’s computer without any action on their part.
As this type of cookie could not be placed without the user’s consent, the Restricted Committee considered that the companies had not complied with the requirement set forth in Article 82 of the French Data Protection Act to obtain prior consent before placing cookies that were not essential to the service.
A failure to inform users of the search engine google.fr
When a user visited the google.fr website, an information banner was displayed at the bottom of the page, bearing the following words “Reminder regarding Google’s privacy policy” in front of which were two buttons entitled “Remind me later” and “Consult now”.
This banner did not provide the user with any information about the cookies that had already been placed on their computer when they arrived on the website. Nor was this information provided to the user when they clicked on the “Consult Now” button.
The Restricted Committee therefore considered that the information provided by the companies did not allow users residing in France to be previously and clearly informed about the placing of cookies on their computer and, consequently, about the objectives of these cookies and the means made available to them as to the possibility of refusing them.
The partial failure of the “opposition” mechanism
When a user disabled the personalization of Google search ads using the mechanism available to them from the “Consult Now” button, one of the ad cookies would remain stored on their computer and continue to read information to the server to which it was attached.
The panel therefore considered that the “opposition” mechanism put in place by the companies was partially defective, in violation of Article 82 of the French Data Protection Act.
The sanction pronounced by the Restricted Committee
The Committee sanctioned the company GOOGLE LLC with a fine of 60 million euros and the company GOOGLE IRELAND LIMITED with a fine of 40 million euros, which were made public.
The Committee justified these amounts in view of the seriousness of the aforementioned triple breach of Article 82 of the French Data Protection Act.
It also highlighted the reach of the Google Search search engine in France and the fact that the companies’ practices affected nearly fifty million users.
Finally, the Committee pointed out the considerable benefits that the companies derive from the advertising revenues indirectly generated from the data collected by these advertising cookies.
The Committee noted that, since an update in September 2020, companies have stopped automatically placing advertising cookies as soon as the user arrives on the google.fr page.
It nevertheless noted that the new information banner implemented by the companies upon arrival on the google.fr page still did not allow users residing in France to understand the purposes for which cookies are used and did not inform them of the fact that they could refuse these cookies.
Therefore, in addition to administrative fines, the Restricted Committee also adopted an injunction under penalty so that the companies proceed to inform people in accordance with Article 82 of the Data Protection Act within 3 months of the notification. Otherwise, the companies will be liable to a penalty payment of 100,000 euros per day of delay.
A competence of the CNIL
In its deliberation, the Restricted Committee recalled that the CNIL is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus stressed that the cooperation mechanism provided for by the GDPR (“one-stop shop” mechanism) was not intended to apply in this procedure since operations related to the use of cookies fall under the “ePrivacy” directive, implemented in Article 82 of the French Data Protection Act.
It considered that the CNIL is also territorially competent under Article 3 of the Data Protection Act because the use of cookies is made within the “framework of activities” of the company GOOGLE FRANCE which is the “establishment” on French territory of GOOGLE LLC and GOOGLE IRELAND LIMITED and promotes their products and services.
It also considered that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED are jointly responsible since they both determine the purposes and means related to the use of cookies.
The articulation of the sanction with the work of the CNIL on cookies
As part of its action plan on advertising targeting and to take into account the entry into force of the GDPR, the CNIL published on October 1, 2020 its amending guidelines and a recommendation on the use of cookies and other tracers. The CNIL asked the actors to comply with the rules thus clarified, considering that this adaptation period should not exceed six months.
On this occasion, it nevertheless specified that it would continue to fully monitor compliance with the other obligations that have not been amended and, if necessary, to adopt corrective measures to protect the privacy of Internet users.
The obligations that the CNIL is sanctioning today regarding non-compliance by companies with the GDPR were pre-existing and are therefore not among those that have been clarified by the new guidelines and the recommendation of October 1, 2020.
Note: The company GOOGLE LLC, based in California, develops the search engine Google Search. GOOGLE IRELAND LIMITED, based in Ireland, is the European headquarters of the Google Group. The company GOOGLE FRANCE is the establishment in France of the company GOOGLE LLC.
EU GDPR Quick Guide to GDPR Fines and Sanctions
The EU’s General Data Protection Regulation (GDPR) was one of the first privacy laws to compel broad organizational compliance, largely...
England and Wales High Court rules that the GDPR Art. 27 Representative is not liable for its clients’ actions
The England and Wales High Court of Justice (May 28th 2021): the GDPR Article 27 Representative is not liable for its client’s actions. On...
Fine of 525,000 euros imposed on non-EU company for failure to appoint EU Representative
UNOFFICIAL ENGLISH TRANSLATION DUTCH DATA PROTECTION AUTHORITY – NEWS...
About the author
Jane Murphy
The General Data Protection Regulation (GDPR) continues to apply to many US companies in 2025, even if they do not have a physical presence in the European Union. Despite years of guidance and enforcement, the same misunderstandings keep reappearing. Here are five of the most common GDPR mistakes US companies make — and how to avoid them.
Mistake 1 – Confusing the Data Protection Officer (DPO) with the EU GDPR Representative
An EU GDPR Representative is a local contact point for data protection authorities and individuals in the EU. Non-EU companies that are subject to the GDPR must appoint a representative to ensure smooth communication and compliance.
A Data Protection Officer (DPO) is responsible for overseeing a company’s internal data protection strategy and ensuring compliance with the GDPR. The DPO monitors data processing, conducts audits, and trains staff.
The DPO works inside the organisation, while the GDPR Representative is based in the EU and acts as an external contact point. Many US companies confuse the two roles, but under the GDPR, they are separate obligations and sometimes both are required.
Mistake 2 – Misunderstanding the extraterritorial scope of the GDPR
The GDPR applies to non-EU companies if they offer goods or services to individuals in the EU or monitor their behaviour online. This applies regardless of where the company is located.
Selling products to EU customers, operating an EU-facing website in EU languages, accepting payments in euros, or tracking EU visitors with cookies or analytics tools can all trigger GDPR obligations.
Mistake 3 – Incorrectly relying on the Privacy Shield (now EU-US Data Privacy Framework)
The Privacy Shield was an agreement that allowed certified US companies to transfer personal data from the EU to the US. In 2020, it was invalidated by the Court of Justice of the European Union in the Schrems II decision.
In 2023, the EU-US Data Privacy Framework (DPF) replaced the Privacy Shield. While participation in the DPF can help facilitate transatlantic data transfers, it does not exempt companies from GDPR compliance.
US companies must ensure that data transfers are lawful under the GDPR. This may involve joining the DPF, using Standard Contractual Clauses (SCCs), or implementing other approved safeguards.
Mistake 4 – Incomplete or unclear privacy policies
The GDPR requires privacy policies to be clear, accessible and transparent. They must explain what personal data is collected, how it is used, the legal basis for processing, and the rights of data subjects.
Many US companies omit details such as data retention periods, contact information for the EU Representative, or instructions on how to exercise data subject rights.
Mistake 5 – Underestimating GDPR fines and enforcement
Data protection authorities have issued fines to companies of all sizes, including non-EU businesses. In 2025, penalties for non-compliance remain high — up to €20 million or 4% of annual global turnover, whichever is higher.
Regular compliance reviews Data Protection Impact Assessments (DPIAs), staff training, and appointing an EU GDPR Representative can help mitigate risks.
How EDPO can help your business stay GDPR compliant
EDPO acts as your official EU GDPR Representative, ensuring compliance with Article 27 of the GDPR and facilitating communication with EU authorities.
For companies targeting the UK market, EDPO also offers UK GDPR Representative services to ensure compliance with the UK’s data protection regime.
Follow us on Linkedin for daily breaking GDPR news!
The General Data Protection Regulation (GDPR) continues to apply to many US companies in 2025, even if they do not have a physical presence in the European Union. Despite years of guidance and enforcement, the same misunderstandings keep reappearing. Here are five of the most common GDPR mistakes US companies make — and how to avoid them.
Mistake 1 – Confusing the Data Protection Officer (DPO) with the EU GDPR Representative
An EU GDPR Representative is a local contact point for data protection authorities and individuals in the EU. Non-EU companies that are subject to the GDPR must appoint a representative to ensure smooth communication and compliance.
A Data Protection Officer (DPO) is responsible for overseeing a company’s internal data protection strategy and ensuring compliance with the GDPR. The DPO monitors data processing, conducts audits, and trains staff.
The DPO works inside the organisation, while the GDPR Representative is based in the EU and acts as an external contact point. Many US companies confuse the two roles, but under the GDPR, they are separate obligations and sometimes both are required.
Mistake 2 – Misunderstanding the extraterritorial scope of the GDPR
The GDPR applies to non-EU companies if they offer goods or services to individuals in the EU or monitor their behaviour online. This applies regardless of where the company is located.
Selling products to EU customers, operating an EU-facing website in EU languages, accepting payments in euros, or tracking EU visitors with cookies or analytics tools can all trigger GDPR obligations.
Mistake 3 – Incorrectly relying on the Privacy Shield (now EU-US Data Privacy Framework)
The Privacy Shield was an agreement that allowed certified US companies to transfer personal data from the EU to the US. In 2020, it was invalidated by the Court of Justice of the European Union in the Schrems II decision.
In 2023, the EU-US Data Privacy Framework (DPF) replaced the Privacy Shield. While participation in the DPF can help facilitate transatlantic data transfers, it does not exempt companies from GDPR compliance.
US companies must ensure that data transfers are lawful under the GDPR. This may involve joining the DPF, using Standard Contractual Clauses (SCCs), or implementing other approved safeguards.
Mistake 4 – Incomplete or unclear privacy policies
The GDPR requires privacy policies to be clear, accessible and transparent. They must explain what personal data is collected, how it is used, the legal basis for processing, and the rights of data subjects.
Many US companies omit details such as data retention periods, contact information for the EU Representative, or instructions on how to exercise data subject rights.
Mistake 5 – Underestimating GDPR fines and enforcement
Data protection authorities have issued fines to companies of all sizes, including non-EU businesses. In 2025, penalties for non-compliance remain high — up to €20 million or 4% of annual global turnover, whichever is higher.
Regular compliance reviews Data Protection Impact Assessments (DPIAs), staff training, and appointing an EU GDPR Representative can help mitigate risks.
How EDPO can help your business stay GDPR compliant
EDPO acts as your official EU GDPR Representative, ensuring compliance with Article 27 of the GDPR and facilitating communication with EU authorities.
For companies targeting the UK market, EDPO also offers UK GDPR Representative services to ensure compliance with the UK’s data protection regime.