---

The French data protection authority (‘CNIL’) announced, on 25 May 2021, that it had issued formal notices to around 20 organizations which do not comply with CNIL’s cookie guidelines and recommendations, ordering them to amend their practices and come into compliance with the same. In particular, CNIL highlighted that the infringements relate to not enabling users to refuse cookies as easily as to accept them, while revealing that most of the addressed organizations are major players in the digital sector, as well as some public bodies. Furthermore, CNIL indicated that the addressed organizations have one month to comply and will incur financial penalties of up to 2% of their turnover if this deadline is not respected.

Additionally, CNIL noted that this is the first campaign of verifications and corrective measures since the entry into effect of the cookie guidelines and recommendations, and that similar actions will be carried out over the coming months, with cookie compliance being a priority for CNIL in 2021.

Finally, CNIL issued a reminder of its recent €100 million fine against Google LLC and Google Ireland Limited and €35 million fine against Amazon Europe Core Sarl of €35 million for cookie violations, highlighting that these decisions were issued prior to the entry into effect of the new cookie guidelines, which were therefore not considered in the decisions, though both companies were reminded of the need to ensure that cookies may be refused as easily as they are accepted in the injunction orders.

You can read the press release, only available in French, here.