Google, SHEIN hit with record fines for cookie violations
What's the story
France's data protection authority has imposed record fines on tech giant Google and fast-fashion retailer SHEIN for violating internet cookie laws. The National Commission on Informatics and Liberty (CNIL) fined SHEIN €150 million ($175 million) and Google a whopping €325 million. Both companies have been found guilty of not obtaining users' free and informed consent before placing advertising cookies in their browsers.
Cookie significance
Cookies and their significance
Cookies are small files that websites store in browsers to collect data about users' online activities. They play a key role in online advertising and the business models of many big platforms. The CNIL has been intensifying its scrutiny of cookie usage as part of a broader strategy to regulate market players over the last five years, especially those with high-traffic sites and services.
Data collection
SHEIN's massive data collection and user consent issues
SHEIN, which has 12 million monthly users in France, was found to have collected "massive" amounts of data through cookies. The company failed to obtain user consent or provide sufficient information and options for withdrawing consent. Despite this, SHEIN has since updated its systems in line with CNIL requirements under French and European law and plans to appeal the fine.
Previous fines
Google's 3rd fine for cookie-related violations
The CNIL's fine against Google is its third for cookie-related violations, having previously paid €100 million in 2020 and €150 million in 2021. Prosecutors had sought an even higher penalty this time, of €520 million. The CNIL particularly highlighted Google's "cookie wall" case when creating a Google account, which required users to accept tracking software before proceeding.
Appeal plans
Both companies to appeal fines
Both Google and SHEIN have said they will appeal the fines. Google said it would review the decision, while SHEIN called the fine "totally disproportionate given the nature of the alleged grievances" and its "current compliance" with legislation. Along with the fines, Google has also been ordered to bring its systems into compliance within six months or face additional penalties of €100,000 per day for both itself and its Irish subsidiary.