In France the Commission Nationale de l’Informatique et des Libertés (CNIL) has fined Google €150 million and Facebook €60 mn. for non-compliance with French data protection legislation, which also covers cookies.
As a result of its investigations following the receipt of complaints from members of the public, the CNIL found that the websites facebook.com, google.fr and youtube.com do not make refusing cookies as easy as to accept them and so penalised them financially. The €150 mn. fine for Google is broken down into €90 mn. for Google LLC and €60 mn. for Google Ireland Ltd.
Furthermore, the CNIL also ordered Google and Facebook to provide French-based internet users lwith a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent, within three months. If they fail to do so, the companies will have to pay a penalty of €100,000 euros per day of delay.
The problem of privacy-conscious people being put to unnecessary effort to reject cookies is widespread. For instance, when visiting a Reach plc newspaper site (Reach owns the Mirror, Express and scores of regional news titles around the country. Ed.), users who wish to reject all cookies have to work through the options; this entails four clicks of the mouse, as opposed to one to accept all cookies. The best sites have a one-click option to accept or reject all cookies.
As someone who has been using the internet since the days of dial-up modems, your ‘umble scribe has long believed rejecting cookies should be the default and those who want to accept them made to go through the same laborious process to which cookie refuseniks are currently subjected.