France fines Amazon $42M for dropping tracking cookies without consent
Between December 12, 2019 and May 19, 2020, the CNIL(French Data Protection Agency) carried out several checks, particularly online, on the amazon.fr website. These verifications revealed:
- when an internet user visited this site, a large amount of cookies (with an advertising objective) were automatically placed on his computer, without any action on his part.
- when an Internet user who went to the amazon.fr site, the information provided was neither clear nor complete.
- the information banner displayed by the company, in this case “By using this site, you accept our use of cookies to provide and improve our services. Find out more ”, contained only a general and approximate description of the purposes of all the cookies placed.
- when internet users who went to the Amazon.fr site after having clicked on an ad published on another website, the same cookies were placed without any information delivered to Internet users.
The French regulator found that this type of cookies, not essential to the service, can only be placed after the Internet user has expressed their consent. Placing cookies upon arrival on the site is a practice which, by nature, is incompatible with prior consent.
The regulator also found that until the redesign of the amazon.fr site, in September 2020, the company placed cookies on the computers of Internet users residing in France without providing them with the required information in accordance with article 82 of the Data Protection Act. The instantaneous deposit of cookies, combined with the absence of any information, particularly infringed the rights of Internet users.
Further regulation:
In October 2019, a ruling from Court of Justice of the European Union(CJEU) further clarified that consent must be obtained prior to storing or accessing non-essential cookies.
A year later, CNIL has made investigating cookie compliance a particular focus — publishing updated guidance for using the tracking tech, when it said it would offer a grace period of up to six months to come into compliance.
Reference:
