France hits Google with $85M fine as new laws take effect

Stemming from an investigation that began in May - the day after Europe's strict new data privacy rules known as GDPR went into effect - France's data protection authority has announced a $57 million fine against Google in the first such GDPR penalty levied against a United States technology company.

The French agency, CNIL, ruled today that the search giant had offered users inadequate information, spreading it across multiple pages, and had failed to gain valid consent for ads personalisation.

Even companies which are not based in Europe must follow the tough new rules if they want their sites and services to be available to European users.

An investigation into complaints filed against Google a year ago revealed that users were "not sufficiently informed" about its data consent policies, CNIL said.

"We have found that large corporations such as Google simply "interpret the law differently" and have often only superficially adapted their products", Schrems said in a statement after the ruling.

The two complaints were filed jointly on the day the law went into effect by the French digital advocacy group La Quadrature du Net and the group Noyb.eu, a watchdog organization started by Max Schrems.

The regulator also pointed out that Google is "too generic and vague" when telling users how it will use their data, and there is also information missing about how long the data will be stored.

"We're studying the decision to determine our next steps", it said.

"The information on processing operations for the ads personalization is diluted in several documents and does not enable the user to be aware of their extent", the CNIL said.

The CNIL said Google made it too hard for users to understand and manage preferences on how their personal information is used, in particular with regards to targeted advertising.

Google parent Alphabet recorded $110.8 billion in revenues for 2017, meaning CNIL could have theoretically hit the company with a fine of nearly €4 billion.

Although Google responded to the decision by saying that they committed to meeting the "high standards of transparency and control" expected of them by users - as well as by the strict new European Union data law - they are nonetheless challenging the decision.

Indeed, the user not only has to click on the button "More options" to access the configuration, but the display of the ads personalization is moreover pre-ticked. In both cases, France said that Google had erred. The GDPR is the world's first major attempt to regulate large tech firms like Google, Facebook, Amazon, etc., and is forcing those companies to critically examine their own policies and procedures when it comes to data collection.

  • Eleanor Harrison