Record fines against Google & Shein for cookies and inbox advertising

The French data protection authority CNIL is continuing to take consistent action against breaches in the handling of cookies and inbox advertising. In several decisions published on Monday, it imposed a fine totaling 325 million euros on Google and 150 million euros on the Chinese fast fashion platform Shein. In particular, it sanctioned non-compliance with cookie rules. The CNIL sees the fines as part of its numerous measures to curb "non-compliant practices in the tracking and targeting of internet users".

Background: Following a complaint from the Austrian civil rights organization Noyb in August 2022, the CNIL carried out several inspections of the Gmail email service and the process for creating a Google account. They revealed that Google Ireland and the US parent company were displaying inbox advertising in the "Advertising" and "Social networks" tabs of Gmail. The inspectors came to the conclusion that such advertisements would have required the consent of Gmail users under the French Postal and Electronic Communications Act.

The inspectors also found that users were encouraged to select cookies for the display of personalized advertising when creating a Google account. In addition, the internet giant did not clearly inform them that the storage of browser files for advertising purposes was a prerequisite for accessing Google's services. According to the CNIL, her consent obtained in this context was therefore invalid and constituted a breach of French data protection law.

Trump is likely to be not amused

The data protection authorities have also ordered Google to take measures within six months to stop displaying advertising between emails in Gmail users' inboxes without prior consent. They also ordered Google to obtain valid consent from users for the placement of advertising cookies when creating a Google account. Otherwise, Google in the USA and Ireland will each have to pay a fine of 100,000 euros per day of delay. To make matters worse, the CNIL had already sanctioned the search engine giant twice in 2020 and 2021 for violations in connection with cookies.

When determining the fine for Shein, the supervisory authority considered the fact that the online retailer did not fulfill several obligations. For example, it had placed some cookies without users' consent, had not respected their decisions, and had not adequately informed them about the files crumbled onto their hard disk. Shein described the penalty as "completely disproportionate" and announced an appeal. Google referred to data protection improvements already introduced. The company intends to review the decisions thoroughly. The Google sanction is unlikely to please US President Donald Trump, as he increased the pressure on the EU following the conclusion of a customs deal. For example, he threatened to impose high surcharges on countries that introduce "discriminatory" rules or taxes against US tech companies.

(nie)