Two 2020 cookie banners cost Google and Amazon 135 million euros

The revenue mechanism

An advertising cookie is only lawful in France if a user has actually consented before it is placed, and on 7 December 2020 the CNIL, France's data protection authority, fined two of the largest publisher-facing platforms for skipping that step. Its own decision on Google states the restricted committee fined Google LLC 60 million euros and Google Ireland Limited 40 million euros, a combined 100 million euros, for placing advertising cookies on visitors to google.fr without prior consent or adequate information. The same day's decision on Amazon states Amazon Europe Core was fined 35 million euros for the same underlying practice on amazon.fr, following an investigation the CNIL conducted between December 2019 and May 2020.

What the documents show

Both CNIL decisions describe specific, named breaches rather than a general finding. For Google, the CNIL states it found cookies were placed automatically on arrival at google.fr, that the site's banner did not explain what the cookies were for even after a user clicked its own opt-out button, and that the opt-out mechanism itself was only partly effective, leaving one advertising cookie active. The CNIL's decision states this affected roughly fifty million French users of Google Search and separately notes Google had already stopped auto-placing the cookies by the time of the decision, following a September 2020 update, though it found the disclosure still inadequate. For Amazon, the CNIL states its banner, reading only that using the site meant accepting cookies to improve services, did not clearly disclose that the cookies were mainly used for personalized advertising or explain how to refuse them.

The assumptions exposed

Both fines rest on France's ePrivacy-derived cookie consent rule, not the GDPR's one-stop-shop mechanism; the CNIL states it considered itself competent to act alone because cookie placement falls outside that mechanism. Neither decision claims the companies acted in bad faith across their whole business; each is a finding about one banner and one technical default on one national site at one point in time, and the CNIL notes both companies had already changed their designs before the decision was published. A combined figure, such as the roughly 135 million euros here, adds two separate national decisions against two different corporate structures, not one joint judgment.

What to check before you rely on it

This is an editorial checklist. Before citing this case as proof a vendor's current cookie practice is unlawful, check that its present-day banner still resembles what the CNIL described, since both companies changed designs afterward; check current guidance, not this one historical record.

• Does my own site's cookie banner disclose cookie purposes before any non-essential cookie is placed, as the CNIL found lacking here?
• If I offer an opt-out control, does it actually stop every related cookie, or only some of them?
• Am I treating a 2020 enforcement decision as a description of today's product, when both companies have since changed their designs?

The CNIL's decisions are a record of what two specific banners and defaults did in 2020, not a permanent verdict on either company's current advertising practices.