15 ms·

CNIL imposes a financial penalty of 50M euros against Google

330 points by Aissen 8y ago

gamma-male 8y ago
I really hate that if I start looking for bdsm stuff on Amazon I start having bdsm related ads everywhere. It's really uncomfortable when friends are shoulder surfing.
- jliptzin 8y ago
  Just have 2 amazon accounts, SFW version and NSFW version
  - agumonkey 8y ago
    I guess that's why firefox containers are for, just don't forget to name it 'vintage-math-books'
- kome 8y ago
  The only ethical thing to do, is to block advertisement: https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/
- gnode 8y ago
  I don't know if this will help in your specific case, but Amazon has an advertising preferences section in your account settings, where you can opt to "Do not show me interest-based ads provided by Amazon".
- kasey_junk 8y ago
  https://www.amazon.com/adprefs https://www.amazon.com/adprefs
Aissen 8y ago
Google Translate link (of the irony): https://translate.google.com/translate?hl=&sl=auto&tl=en&u=https%3A%2F%2Fwww.cnil.fr%2Ffr%2Fla-formation-restreinte-de-la-cnil-prononce-une-sanction-de-50-millions-deuros-lencontre-de-la https://translate.google.com/translate?hl=&sl=auto&tl=en&u=h... And the full decision (in french, too) for anyone wanting to read 31 pages of scanned legalese (not too harsh, though): https://www.cnil.fr/sites/default/files/atoms/files/san-2019-001_21-01-2019.pdf https://www.cnil.fr/sites/default/files/atoms/files/san-2019...
- ernesth 8y ago
  Official announce in english: https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi...
  - sctb 8y ago
    Thanks, we've updated the link from https://www.cnil.fr/fr/la-formation-restreinte-de-la-cnil-prononce-une-sanction-de-50-millions-deuros-lencontre-de-la https://www.cnil.fr/fr/la-formation-restreinte-de-la-cnil-pr....
  - Aissen 8y ago
    Thanks, I didn't find it when posting the link. If a mod could update it it would be nice !
  - yrf 8y ago
    That translation is only marginally better than the automatic Google Translate translation.
    - nolok 8y ago
      The CNIL has a very constrained budget (since the need for them keep increasing, and their income doesn't), so spending money for an english translation is probably not very high on their list. I would not be surprised if it's one of their regular employee that just happened to speak english that do those.
      - zozbot123 8y ago
        > I would not be surprised if it's one of their regular employee that just happened to speak english that do those. For very low values of "speak english", of course - this is France after all. That translation is so peculiar, it reminds me of the Chinglish manuals we get with cheap manufactured products.
ekingr 8y ago
English version: https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi...
maa5444 8y ago
not 500? strange
loldot_ 8y ago
Its ironic that cnil has “accept all” as the default choice for 3rd party cookies on its site
- blub 8y ago
  Very few websites have implemented this properly, I think I've seen only 1-2 newspapers. The rest either have an "accept all" or "pre-ticked accept" or a tiny, misleading "more options".
  - bertil 8y ago
    I think that the Cnil should lead by example and I suspect that a lot of people see the irony. If they show what can be done, or even better, open-source a working solution, that could disprove the “everyone does it” argument which… hasn’t exactly proven sturdy to even minimal ethical testing so far.
    - geodel 8y ago
      I lived in an asian city where private buses could be fined even if they have one person extra than total seating capacity. Meanwhile govt buses could be so over crowded that people can fall off the door and bus wouldn't stop over that incident. So government and bureaucracies can be impervious to rules they expect everyone to follows. This site seems humongous fan of bureaucracy as long as it is european.
- nolok 8y ago
  Honestly, I think what they offer might be the best solution you can hope for: one button "I don't care", one button personalize and in it one button "disable all". People who don't care and just want the site to work aren't lost, people who care aren't lost, people who want to personnalize aren't lost. If you care, it's two click total to disable everything, and it's very easy to find (the bright right "deny"). Should they have "refuse all" along with "accept all" ? Yes. Should "refuse all" be the default and thus features be disabled ? I'm not entirely sure (see what they list in the personnalize, it's youtube videos and twitter cards ...). In terms of the intent of the law (give control to the user and make it easy to opt out), I would say they are doing fine. As opposed to all those shitty websites where you can't find how to disable, or you have to disable a bazillion things by hand.
MarkMc 8y ago
I'm not surprised by this. It's pretty clear that having a pre-ticked checkbox is not allowed under GDPR. It's also against the intent of the law to require 6 clicks to deny consent but only 1 click to grant it.
- CorvusCrypto 8y ago
  What's not allowed is pre-checked opt-in. As France mentioned that's not the case for google. Only a default configuration is pre-checked. The opt-in is a separate immediately seen checkbox saying you agree to data usage for personalization etc. Along with a link explaining how to adjust. Edit: I should say that this approach was deemed acceptable by Swedens dataskyddsmyndighet which is the government regulatory agency and is a common approach in many sites.
  - MarkMc 8y ago
    Perhaps I misunderstood and was relying too much on my memory of the Google UI when I was in the UK. Is there a youtube video or series of screenshots showing exactly how to grant or deny consent with Google?
  - gamma-male 8y ago
    Bless you
- ahje 8y ago
  This is going to be one helluva ride; there's thousands of web site using the same kind of implementation, and a 50M fine does send quite a message.
  - easytiger 8y ago
    > and a 50M fine does send quite a message. Yes it sends the message that France is going to keep trying to attack google & facebook until they relent and exit Ireland
    - 8y ago
deleted 8y ago
[deleted]
akavel 8y ago
As an European: <3 <3 <3 Also: "This is the first time that the CNIL applies the new sanction limits provided by the GDPR." I'm super happy the law is hopefully finally starting to get some teeth. I sincerely hope it gets successfully tested in court, and that lawyers will smell money in slamming down on companies trying to blatantly fake their way out of GDPR by cheating users into "accepting" the pre-GDPR status quo.
- buboard 8y ago
  As a european i disagree. This is not a good ruling for anyone who has their business in europe. It reads petty and kinda-insane. And i just don't get the "suck it americans" kool-aid that the whole of the EU is into atm.
MarkMc 8y ago
Does this mean that the consent Google has already obtained from users is invalid, and so they must request consent again in a GDPR-compliant manner?
- renholder 8y ago
  Yes, as Google's argument was "...but we already got permission". >The company GOOGLE states that it obtains the user’s consent to process data for ads personalization purposes. However, the restricted committee considers that the consent is not validly obtained for two reasons...
- olivierduval 8y ago
  No, consents given BEFORE GDPR are considered valid. But, new google accounts are created everyday... and this apply to them
  - Aissen 8y ago
    Have you read the part about consent given during account creation ?
    - olivierduval 8y ago
      Sorry for being unclear: - for Google accounts created and Android smartphone configured before GDPR (25/5/2018), consent is considered valid under GDPR - for Android smartphone configured AFTER 25/5/2018, the consent is considered invalid, whatever the Android version or the time that the phone is sitting on the shelf, or whether the Google account already exist or not. - moreover the consent is invalid for the Google account creation during the android smartphone configuration Google is fined "only" for what happen AFTER the GDPR (25/5/2018): android configuration and account creation.
CorvusCrypto 8y ago
This is an interesting case. So France is essentially arguing that not only should opt-in be visible (as they mention it is on Google's create account page), but that configuration should be immediately visible as well. This will screw over much more than google should it be upheld. It's interesting that this wasn't brought up to my employer in sweden. We had default data collection settings checked and in a separate view accessible by a similar "more options" toggle and it was deemed okay as long as we had a visible blanket opt-in checkbox and a link explaining the settings, how we use data, and how to adjust. Our regulators said it would be enough as the goal of GDPR is to make every use of data reasonably known, adjustable, and revokation with good faith toward the user. Yet here it seems France is arguing that it is about immediate showing of all settings to the user and that every website should tell in the user's face about every single configuration of data usage. It's possibly a good approach, idk, I feel it is a bit too annoying of a precedent and that they are nitpicking a bit. I can't wait for this to fully play out. Regarding documentation and informing the user, I disagree with their findings entirely about the frustration of finding data usage info as all of Frances concerns were lost on me upon visiting https://safety.google/privacy/data/ https://safety.google/privacy/data/. To me it seems that google has made a good faith effort at least in documentation.
- the_duke 8y ago
  I agree that this would put basically any service in existence into non-compliance. As a user, I do agree that a "blanket opt in" button/ default checked checkbox is so pointless that it could as well be left out. A EASILY DIGESTIBLE page explaining what data is stored and how it is used , with an agree button at the end (and separate opt-in for different sets of data/functionality) should be mandatory. Emphasis on the easily digestible, because we all know that the "terms and contions" pages out there are constructed to be as obtuse and uninformative as possible to make users just skip them.
  - zAy0LfpBZLC8mAC 8y ago
    > I agree that this would screw over basically all services in existence. So, the market is so skewed that that is how presumably somewhat informed people perceive it? I mean, I would think it is just obvious bullshit. There are plenty of businesses that sell you a service for money, and that is all they do, and this kind of regulation has exactly zero impact on them. The only problem is that they have to compete with others who simply mistreat their customers in order to be able to ask for less money--so it's about time that a level playing field is restored where it's obvious that anti-asshole regulation does not impact everyone.
LeanderK 8y ago
50M euros seems far too little to me. It's a major violation against a fundamental regulation in their core product and compared to their revenue, 50M is nothing. A magnitude more will probably get google thinking, but I doubt this will.
- zaldun 8y ago
  There are complaints like this in almost every European countries. If it's 50M fine in France, 50 more in Germany, 50 in The Netherlands and so on, it should start to be a huge amount!
  - eeZah7Ux 8y ago
    To fine the company for merely 5% of their $110 bln revenue it would take 110 countries. Compared to the average US income, $50M is 15$.
    - olivierduval 8y ago
      In case of repeated and obvious offense (not the case of Google for now), the fine may grow up until 4% of the annual revenue... For each case !
    - chillacy 8y ago
      Is that 100 billion from all countries? If fines from EU exceeds profits from EU then that division would be bust, it’s more like 25 billion.
    - eeZah7Ux 8y ago
      So many downvotes. Never criticize our corporate overlords.
- ahje 8y ago
  Google will now be expected to do it all over, and follow the rules. If they fail, the fine will most likely be much higher.
- onetimemanytime 8y ago
stevespang 8y ago
CHUMP CHANGE for an outfit as big as Google, their lawyers are all "high fiving" . . . .
olivierduval 8y ago
"OK Google" ;-) Facebook, Amazon... please stay in line!!! :-D I saw so many website, big or small, implementing the GDPR the easy way and call it a day... without any thinking or consideration for their users... that now everybody may gonna think twice ? Google was an example, a message. That's why CNIL chose such a big player 1) it's to big to be really hurt by the fine 2) most other business - a lot smaller - will be frightened and will re-think their slacking approach It's a way to say "don't mess with us". The funniest part is that usually the US administration try to help US business in such case. But I don't think that Trump administration - moreover during shutdown - will...
- klez 8y ago
  > That's why CNIL chose such a big player FWIW, CNIL didn't choose a big player. They're responding to complaints advanced by the two associations mentioned in TFA, that is La Quadrature du Net and None Of Your Business.
  - olivierduval 8y ago
    You're right. In fact, they could have choose Google, because they may act by their own without any complaint. But they choose the amount ;-)
  - DannyBee 8y ago
    What? Of course they chose. They have received the same complaints about literally thousands of companies, and chose to advance these two first. Regulators (no matter where) always make strategic decisions about who to prosecute and when. That's part of the job. I'm not sure why we are trying to pretend they are robotic automatons who just process complaints exactly as received.
    - puzzle 8y ago
      In interviews back before GDPR, the CNIL stated that, when the maximum fines allowed weren't enough, they saw the PR embarrassment of making their rulings public, which is not required, an even higher punishment for Google. So they have been making strategic decisions for a while.
dennisgorelik 8y ago
CNIL forces bad UX pattern on EU users. The correct pattern would be to use reasonable default settings and allow more advanced users to customize. But EU wants to force Google to present advanced configuration options to all users. For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all. That CNIL change will make the Web worse than it is now, not better.
- xg15 8y ago
  I think they are perfectly free to present an unticked "personalize ads" box as a reasonable default. > For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all. Hiding the (pre-ticked) consent boxes in "advanced configuration" UI has been the default strategy so far. This fine made clear that this doesn't actually work to obtain valid consent.
  - dennisgorelik 8y ago
    Why do you think that an unticked "personalize ads" box is a reasonable default? I, personally, when I browse internet, strongly prefer personalized ads (over non-personalized ads). Most users, probably, do not care either way (because they do not understand the implications). But the business (e.g. Google) cares about ads personalization a lot, because ads personalization significantly increases tax revenue and reduces number of irrelevant ads that users see. In this situation the reasonable default choice is to allow ads personalization, so the business will have ad revenue to function and deliver functionality users need.
    - xg15 8y ago
      In this case, the EU per their democratic processes decided they need additional consent. Easy as that. > because they do not understand the implications This is the point. Relying on people not understanding something is not ethical and certainly not "reasonable".
mtgx 8y ago
> On 25 and 28 May 2018, the National Data Protection Commission (CNIL) received group complaints from the associations None Of Your Business (“NOYB”) and La Quadrature du Net (“LQDN”). As corporations become greedier, people more privacy-aware, and leaked data more abused by criminals, I think it's only a matter of time before Max Schrems (guy behind noyb and the fall of EU-US Safe Harbor agreement) is named Time's Person of the Year.
plandis 8y ago
I find it fascinating that Google gets a 50M fine for not having the exact UX experience France thinks they should have but then fines a French company 250K for breach of actual user data. Makes sense.
- MattHeard 8y ago
  GDPR fines are intended to generally be proportional to the company's revenue.
  - laurentl 8y ago
    Furthermore, this is the first fine falling under GDPR. The previous fines handed out by the CNIL were pre-GDRP, with much lower maximum amounts (300 k€). So a 250k€ fine is close to the maximum they could fine, which makes sense given the offense.
_bxg1 8y ago
Google made $32.32 billion in Q4 2018. That's $384.76 million per day. Fines this small accomplish nothing.
- colejohnson66 8y ago
  But the fine increases with non compliance up to 4% of their yearly revenue
  - _bxg1 8y ago
    Well then that's good, because this may as well be a verbal warning
- DanBC 8y ago
  I'd love the boss where an avoidable €50m loss isn't a big deal.
- pewdiepotpie 8y ago
  I agree with you, I would also suggest, fines are a niggling mentality. A non serially compliant like google should have its financial holdings [all of them] taken into receivership, and appropriately docked until they comply or liquidate and cease operations. now there are some big pointy nasty teeth to have sink in to the bone
  - _bxg1 8y ago
    Revenue is the reward mechanism of capitalism; fines are great as long as they're big enough. I think the percentage route is the way to go. Corporations make all their decisions based on risk/cost/reward; if it costs X to respect people's privacy, and it costs Y (via fines) to not respect people's privacy, you just have to balance that equation. Shareholders will do the rest.
    - pewdiepotpie 8y ago
      yes revenue is the reward, however when a big bad kid uses his toys to assault anyone else in the sandbox we take those things away. the fines being levied are no where near enough to be punitive, and can be simply shrugged off as a cost of operation. If googles executive was relieved of thier positions even temporarily by a court appointed 3rd party for the purpose of remaking google in a compliant form, the problem would end dead stop.
srkmno 8y ago
This is exceedingly petty even considering that the GDPR as a whole is a tool to subject US tech firms to a degree of scrutiny and control that would suffocate other industries and extract the occasional payout. No one benefits from this, they just get shitty UX.
ChuckMcM 8y ago
It will be interesting to see how this plays out. Between the GPDR imposing costs on the advertising model and Google being pressured not to go into China, its more pressure on the top line of earnings.
- dennisgorelik 8y ago
  Google would be fine, because Google's competitors (especially small ones) would suffer more than Google itself. However EU users would suffer from GDPR fallout: - Less services (due to lack of competition). - Annoying cookies/privacy questions, force by GDPR.
dennisgorelik 8y ago
> the economic model of the company is partly based on the ads personalization. Therefore, it is of its utmost responsibility to comply with the obligations on the matter. "Therefore" reasoning works in the opposite direction than CNIL bureaucrats claim. If Google is known for ads personalization, then: 1) Users who decided using Google services should imply that Google will try to personalize their ads by default. 2) In order to "comply with obligation" to deliver ads personalization, Google should turn on "ads personalization" by default.
- rippeltippel 8y ago
  > If Google is known for ads personalization... If you ask 100 random people what is Google for, how many people do you think will answer "ads personalization"? My prediction is "close to 0%". Google's "About" page states: "Our mission is to organise the world’s information and make it universally accessible and useful". No mention of personalization involved. Therefore, Google is NOT known for ads personalization.
  - dennisgorelik 8y ago
    A correct question to "100 random people" would be "Does Google do ads personalization". My guess is that 70 people would not even know what "ads personalization" is. Out of remaining 30 people, 28 would correctly claim that Google does ads personalization.
amluto 8y ago
The top of the CNIL site literally says: > If you continue to browse this website, you accept third-party cookies used to offer you videos, social sharing buttons, contents from social platforms. That looks like an illegal opt out. They should fine themselves :)
- mehrdadn 8y ago
  Yeah... how does that work? Are they really this blind to what they themselves are doing?
  - maaaats 8y ago
    Do you think whatever cookie they may set can be compared to the personal data google has on you? The world isn't black and white.
- readyp1 8y ago
  If you look just to the right of that statement, there's a button labeled Personalize that lets you set which 3rd party services you consent to. Correct me if I'm wrong, but that appears compliant...
  - michaelmrose 8y ago
    Why can't we just set a single setting and have every website obey it?
    - amaccuish 8y ago
      It's called Do-Not-Track and was ignored...
      - mehrdadn 8y ago
        If GDPR required websites to obey DNT would it still be ignored?
alkonaut 8y ago
Hope they go after one of the ”cookiebot”-type splash sites next. What I mean is those that only have ”consent” or “leave”. It’s a clear violation of the GDPR and yet tons of sites do it.
- tzs 8y ago
  Will going after those sites actually accomplish much? They'll just add a third option, "pay", which lets you buy access without them storing personal information (other than information they need to recognize paid users, of course). Almost no one will actually pick the "pay" option, so for most practical purposes it effectively reduces to either "consent" or "leave".
  - alkonaut 8y ago
    I'd be perfectly happy to see what effectively is 3 optionsn "pay with money" "pay with info" or "leave". Whether or not people choose the same option anyway doesn't matter, it's now a much more informed choice than before as it's obvious how much your information is actually worth. Also, sites that can't be bothered to set up premium/paid access mihgt do go the LA Times route and block access in Europe which I also think is completely OK.
gnode 8y ago
Although 50M EUR is a minor fine for a corporation the size of Google, this goes beyond a "warning in writing in cases of first and non-intentional non-compliance". Does this mean that Google has been previously given such a warning and violated it, or that they've been judged to have intentionally not complied?
ddebernardy 8y ago
50M EUR seems like a rounding error. Isn't Google earning over 30Bn USD per quarter?
- DeonPenny 8y ago
  Not if it's just profit from europe
  - ddebernardy 8y ago
    Even then, if you assume Europe is somewhere between a 4th and a 3rd of their total revenue - which I'd expect it to be, given how the EU is a larger economy than the US and Google is even more dominant in Europe than in the US, and irrespective of ad budgets being traditionally lower than in the US - it seems tiny.
Animats 8y ago
For Google, this is small. Remember when they had to pay US$500M to the US DOJ for knowingly assisting in pushing drugs?[1] [1] https://www.wired.com/2013/05/google-pharma-whitaker-sting/ https://www.wired.com/2013/05/google-pharma-whitaker-sting/
amriksohata 8y ago
The EU is bringing a copyright law in soon, who knew the EU would be the one bringing down the internet
buboard 8y ago
This is how you weaponize legislation. I 'll be damned if "They are going after the big guys". Just reading the ruling tells you that any DPA can come up with any kind of justification if they have a beef against you. Not only the law is vague, now they can fine our businesses because we have "buttons and links on which it is required to click to access complementary information". And this is only the DPA of France. There are much more corrupt governments and officials across EU countries. Romania is already having some fun with it. Good luck to everyone , but i m expecting this to backfire spectacularly in the medium term.
alt_f4 8y ago
These fines are really just a way for European govts to claw back money which they feel they are owed by American tech companies for being successful in European markets. In a global world, that's a wrong way to look at things. It is time to cut admin fat in EU govts and stop penalizing productive businesses.

330 points by Aissen 8y ago

I really hate that if I start looking for bdsm stuff on Amazon I start having bdsm related ads everywhere. It's really uncomfortable when friends are shoulder surfing.

jliptzin 8y ago
Just have 2 amazon accounts, SFW version and NSFW version
- agumonkey 8y ago
  I guess that's why firefox containers are for, just don't forget to name it 'vintage-math-books'
kome 8y ago
The only ethical thing to do, is to block advertisement: https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/
gnode 8y ago
I don't know if this will help in your specific case, but Amazon has an advertising preferences section in your account settings, where you can opt to "Do not show me interest-based ads provided by Amazon".
kasey_junk 8y ago
https://www.amazon.com/adprefs https://www.amazon.com/adprefs

Aissen 8y ago

Google Translate link (of the irony): https://translate.google.com/translate?hl=&sl=auto&tl=en&u=https%3A%2F%2Fwww.cnil.fr%2Ffr%2Fla-formation-restreinte-de-la-cnil-prononce-une-sanction-de-50-millions-deuros-lencontre-de-la https://translate.google.com/translate?hl=&sl=auto&tl=en&u=h... And the full decision (in french, too) for anyone wanting to read 31 pages of scanned legalese (not too harsh, though): https://www.cnil.fr/sites/default/files/atoms/files/san-2019-001_21-01-2019.pdf https://www.cnil.fr/sites/default/files/atoms/files/san-2019...

ernesth 8y ago
Official announce in english: https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi...
- sctb 8y ago
  Thanks, we've updated the link from https://www.cnil.fr/fr/la-formation-restreinte-de-la-cnil-prononce-une-sanction-de-50-millions-deuros-lencontre-de-la https://www.cnil.fr/fr/la-formation-restreinte-de-la-cnil-pr....
- Aissen 8y ago
  Thanks, I didn't find it when posting the link. If a mod could update it it would be nice !
- yrf 8y ago
  That translation is only marginally better than the automatic Google Translate translation.
  - nolok 8y ago
    The CNIL has a very constrained budget (since the need for them keep increasing, and their income doesn't), so spending money for an english translation is probably not very high on their list. I would not be surprised if it's one of their regular employee that just happened to speak english that do those.
    - zozbot123 8y ago
      > I would not be surprised if it's one of their regular employee that just happened to speak english that do those. For very low values of "speak english", of course - this is France after all. That translation is so peculiar, it reminds me of the Chinglish manuals we get with cheap manufactured products.

ekingr 8y ago

English version: https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi...

maa5444 8y ago

not 500? strange

loldot_ 8y ago

Its ironic that cnil has “accept all” as the default choice for 3rd party cookies on its site

blub 8y ago
Very few websites have implemented this properly, I think I've seen only 1-2 newspapers. The rest either have an "accept all" or "pre-ticked accept" or a tiny, misleading "more options".
- bertil 8y ago
  I think that the Cnil should lead by example and I suspect that a lot of people see the irony. If they show what can be done, or even better, open-source a working solution, that could disprove the “everyone does it” argument which… hasn’t exactly proven sturdy to even minimal ethical testing so far.
  - geodel 8y ago
    I lived in an asian city where private buses could be fined even if they have one person extra than total seating capacity. Meanwhile govt buses could be so over crowded that people can fall off the door and bus wouldn't stop over that incident. So government and bureaucracies can be impervious to rules they expect everyone to follows. This site seems humongous fan of bureaucracy as long as it is european.
nolok 8y ago
Honestly, I think what they offer might be the best solution you can hope for: one button "I don't care", one button personalize and in it one button "disable all". People who don't care and just want the site to work aren't lost, people who care aren't lost, people who want to personnalize aren't lost. If you care, it's two click total to disable everything, and it's very easy to find (the bright right "deny"). Should they have "refuse all" along with "accept all" ? Yes. Should "refuse all" be the default and thus features be disabled ? I'm not entirely sure (see what they list in the personnalize, it's youtube videos and twitter cards ...). In terms of the intent of the law (give control to the user and make it easy to opt out), I would say they are doing fine. As opposed to all those shitty websites where you can't find how to disable, or you have to disable a bazillion things by hand.

MarkMc 8y ago

I'm not surprised by this. It's pretty clear that having a pre-ticked checkbox is not allowed under GDPR. It's also against the intent of the law to require 6 clicks to deny consent but only 1 click to grant it.

CorvusCrypto 8y ago
What's not allowed is pre-checked opt-in. As France mentioned that's not the case for google. Only a default configuration is pre-checked. The opt-in is a separate immediately seen checkbox saying you agree to data usage for personalization etc. Along with a link explaining how to adjust. Edit: I should say that this approach was deemed acceptable by Swedens dataskyddsmyndighet which is the government regulatory agency and is a common approach in many sites.
- MarkMc 8y ago
  Perhaps I misunderstood and was relying too much on my memory of the Google UI when I was in the UK. Is there a youtube video or series of screenshots showing exactly how to grant or deny consent with Google?
- gamma-male 8y ago
  Bless you
ahje 8y ago
This is going to be one helluva ride; there's thousands of web site using the same kind of implementation, and a 50M fine does send quite a message.
- easytiger 8y ago
  > and a 50M fine does send quite a message. Yes it sends the message that France is going to keep trying to attack google & facebook until they relent and exit Ireland
  - 8y ago

deleted 8y ago

[deleted]

akavel 8y ago

As an European: <3 <3 <3 Also: "This is the first time that the CNIL applies the new sanction limits provided by the GDPR." I'm super happy the law is hopefully finally starting to get some teeth. I sincerely hope it gets successfully tested in court, and that lawyers will smell money in slamming down on companies trying to blatantly fake their way out of GDPR by cheating users into "accepting" the pre-GDPR status quo.

buboard 8y ago
As a european i disagree. This is not a good ruling for anyone who has their business in europe. It reads petty and kinda-insane. And i just don't get the "suck it americans" kool-aid that the whole of the EU is into atm.

MarkMc 8y ago

Does this mean that the consent Google has already obtained from users is invalid, and so they must request consent again in a GDPR-compliant manner?

renholder 8y ago
Yes, as Google's argument was "...but we already got permission". >The company GOOGLE states that it obtains the user’s consent to process data for ads personalization purposes. However, the restricted committee considers that the consent is not validly obtained for two reasons...
olivierduval 8y ago
No, consents given BEFORE GDPR are considered valid. But, new google accounts are created everyday... and this apply to them
- Aissen 8y ago
  Have you read the part about consent given during account creation ?
  - olivierduval 8y ago
    Sorry for being unclear: - for Google accounts created and Android smartphone configured before GDPR (25/5/2018), consent is considered valid under GDPR - for Android smartphone configured AFTER 25/5/2018, the consent is considered invalid, whatever the Android version or the time that the phone is sitting on the shelf, or whether the Google account already exist or not. - moreover the consent is invalid for the Google account creation during the android smartphone configuration Google is fined "only" for what happen AFTER the GDPR (25/5/2018): android configuration and account creation.

CorvusCrypto 8y ago

This is an interesting case. So France is essentially arguing that not only should opt-in be visible (as they mention it is on Google's create account page), but that configuration should be immediately visible as well. This will screw over much more than google should it be upheld. It's interesting that this wasn't brought up to my employer in sweden. We had default data collection settings checked and in a separate view accessible by a similar "more options" toggle and it was deemed okay as long as we had a visible blanket opt-in checkbox and a link explaining the settings, how we use data, and how to adjust. Our regulators said it would be enough as the goal of GDPR is to make every use of data reasonably known, adjustable, and revokation with good faith toward the user. Yet here it seems France is arguing that it is about immediate showing of all settings to the user and that every website should tell in the user's face about every single configuration of data usage. It's possibly a good approach, idk, I feel it is a bit too annoying of a precedent and that they are nitpicking a bit. I can't wait for this to fully play out. Regarding documentation and informing the user, I disagree with their findings entirely about the frustration of finding data usage info as all of Frances concerns were lost on me upon visiting https://safety.google/privacy/data/ https://safety.google/privacy/data/. To me it seems that google has made a good faith effort at least in documentation.

the_duke 8y ago
I agree that this would put basically any service in existence into non-compliance. As a user, I do agree that a "blanket opt in" button/ default checked checkbox is so pointless that it could as well be left out. A EASILY DIGESTIBLE page explaining what data is stored and how it is used , with an agree button at the end (and separate opt-in for different sets of data/functionality) should be mandatory. Emphasis on the easily digestible, because we all know that the "terms and contions" pages out there are constructed to be as obtuse and uninformative as possible to make users just skip them.
- zAy0LfpBZLC8mAC 8y ago
  > I agree that this would screw over basically all services in existence. So, the market is so skewed that that is how presumably somewhat informed people perceive it? I mean, I would think it is just obvious bullshit. There are plenty of businesses that sell you a service for money, and that is all they do, and this kind of regulation has exactly zero impact on them. The only problem is that they have to compete with others who simply mistreat their customers in order to be able to ask for less money--so it's about time that a level playing field is restored where it's obvious that anti-asshole regulation does not impact everyone.

LeanderK 8y ago

50M euros seems far too little to me. It's a major violation against a fundamental regulation in their core product and compared to their revenue, 50M is nothing. A magnitude more will probably get google thinking, but I doubt this will.

zaldun 8y ago
There are complaints like this in almost every European countries. If it's 50M fine in France, 50 more in Germany, 50 in The Netherlands and so on, it should start to be a huge amount!
- eeZah7Ux 8y ago
  To fine the company for merely 5% of their $110 bln revenue it would take 110 countries. Compared to the average US income, $50M is 15$.
  - olivierduval 8y ago
    In case of repeated and obvious offense (not the case of Google for now), the fine may grow up until 4% of the annual revenue... For each case !
  - chillacy 8y ago
    Is that 100 billion from all countries? If fines from EU exceeds profits from EU then that division would be bust, it’s more like 25 billion.
  - eeZah7Ux 8y ago
    So many downvotes. Never criticize our corporate overlords.
ahje 8y ago
Google will now be expected to do it all over, and follow the rules. If they fail, the fine will most likely be much higher.
onetimemanytime 8y ago

stevespang 8y ago

CHUMP CHANGE for an outfit as big as Google, their lawyers are all "high fiving" . . . .

olivierduval 8y ago

"OK Google" ;-) Facebook, Amazon... please stay in line!!! :-D I saw so many website, big or small, implementing the GDPR the easy way and call it a day... without any thinking or consideration for their users... that now everybody may gonna think twice ? Google was an example, a message. That's why CNIL chose such a big player 1) it's to big to be really hurt by the fine 2) most other business - a lot smaller - will be frightened and will re-think their slacking approach It's a way to say "don't mess with us". The funniest part is that usually the US administration try to help US business in such case. But I don't think that Trump administration - moreover during shutdown - will...

klez 8y ago
> That's why CNIL chose such a big player FWIW, CNIL didn't choose a big player. They're responding to complaints advanced by the two associations mentioned in TFA, that is La Quadrature du Net and None Of Your Business.
- olivierduval 8y ago
  You're right. In fact, they could have choose Google, because they may act by their own without any complaint. But they choose the amount ;-)
- DannyBee 8y ago
  What? Of course they chose. They have received the same complaints about literally thousands of companies, and chose to advance these two first. Regulators (no matter where) always make strategic decisions about who to prosecute and when. That's part of the job. I'm not sure why we are trying to pretend they are robotic automatons who just process complaints exactly as received.
  - puzzle 8y ago
    In interviews back before GDPR, the CNIL stated that, when the maximum fines allowed weren't enough, they saw the PR embarrassment of making their rulings public, which is not required, an even higher punishment for Google. So they have been making strategic decisions for a while.

dennisgorelik 8y ago

CNIL forces bad UX pattern on EU users. The correct pattern would be to use reasonable default settings and allow more advanced users to customize. But EU wants to force Google to present advanced configuration options to all users. For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all. That CNIL change will make the Web worse than it is now, not better.

xg15 8y ago
I think they are perfectly free to present an unticked "personalize ads" box as a reasonable default. > For vast majority of users advanced configuration options look like mumbo-jumbo, so most users will learn to quickly accept whatever mumbo-jumbo they are presented with -- without reading it at all. Hiding the (pre-ticked) consent boxes in "advanced configuration" UI has been the default strategy so far. This fine made clear that this doesn't actually work to obtain valid consent.
- dennisgorelik 8y ago
  Why do you think that an unticked "personalize ads" box is a reasonable default? I, personally, when I browse internet, strongly prefer personalized ads (over non-personalized ads). Most users, probably, do not care either way (because they do not understand the implications). But the business (e.g. Google) cares about ads personalization a lot, because ads personalization significantly increases tax revenue and reduces number of irrelevant ads that users see. In this situation the reasonable default choice is to allow ads personalization, so the business will have ad revenue to function and deliver functionality users need.
  - xg15 8y ago
    In this case, the EU per their democratic processes decided they need additional consent. Easy as that. > because they do not understand the implications This is the point. Relying on people not understanding something is not ethical and certainly not "reasonable".

mtgx 8y ago

> On 25 and 28 May 2018, the National Data Protection Commission (CNIL) received group complaints from the associations None Of Your Business (“NOYB”) and La Quadrature du Net (“LQDN”). As corporations become greedier, people more privacy-aware, and leaked data more abused by criminals, I think it's only a matter of time before Max Schrems (guy behind noyb and the fall of EU-US Safe Harbor agreement) is named Time's Person of the Year.

plandis 8y ago

I find it fascinating that Google gets a 50M fine for not having the exact UX experience France thinks they should have but then fines a French company 250K for breach of actual user data. Makes sense.

MattHeard 8y ago
GDPR fines are intended to generally be proportional to the company's revenue.
- laurentl 8y ago
  Furthermore, this is the first fine falling under GDPR. The previous fines handed out by the CNIL were pre-GDRP, with much lower maximum amounts (300 k€). So a 250k€ fine is close to the maximum they could fine, which makes sense given the offense.

_bxg1 8y ago

Google made $32.32 billion in Q4 2018. That's $384.76 million per day. Fines this small accomplish nothing.

colejohnson66 8y ago
But the fine increases with non compliance up to 4% of their yearly revenue
- _bxg1 8y ago
  Well then that's good, because this may as well be a verbal warning
DanBC 8y ago
I'd love the boss where an avoidable €50m loss isn't a big deal.
pewdiepotpie 8y ago
I agree with you, I would also suggest, fines are a niggling mentality. A non serially compliant like google should have its financial holdings [all of them] taken into receivership, and appropriately docked until they comply or liquidate and cease operations. now there are some big pointy nasty teeth to have sink in to the bone
- _bxg1 8y ago
  Revenue is the reward mechanism of capitalism; fines are great as long as they're big enough. I think the percentage route is the way to go. Corporations make all their decisions based on risk/cost/reward; if it costs X to respect people's privacy, and it costs Y (via fines) to not respect people's privacy, you just have to balance that equation. Shareholders will do the rest.
  - pewdiepotpie 8y ago
    yes revenue is the reward, however when a big bad kid uses his toys to assault anyone else in the sandbox we take those things away. the fines being levied are no where near enough to be punitive, and can be simply shrugged off as a cost of operation. If googles executive was relieved of thier positions even temporarily by a court appointed 3rd party for the purpose of remaking google in a compliant form, the problem would end dead stop.

srkmno 8y ago

This is exceedingly petty even considering that the GDPR as a whole is a tool to subject US tech firms to a degree of scrutiny and control that would suffocate other industries and extract the occasional payout. No one benefits from this, they just get shitty UX.

ChuckMcM 8y ago

It will be interesting to see how this plays out. Between the GPDR imposing costs on the advertising model and Google being pressured not to go into China, its more pressure on the top line of earnings.

dennisgorelik 8y ago
Google would be fine, because Google's competitors (especially small ones) would suffer more than Google itself. However EU users would suffer from GDPR fallout: - Less services (due to lack of competition). - Annoying cookies/privacy questions, force by GDPR.

dennisgorelik 8y ago

> the economic model of the company is partly based on the ads personalization. Therefore, it is of its utmost responsibility to comply with the obligations on the matter. "Therefore" reasoning works in the opposite direction than CNIL bureaucrats claim. If Google is known for ads personalization, then: 1) Users who decided using Google services should imply that Google will try to personalize their ads by default. 2) In order to "comply with obligation" to deliver ads personalization, Google should turn on "ads personalization" by default.

rippeltippel 8y ago
> If Google is known for ads personalization... If you ask 100 random people what is Google for, how many people do you think will answer "ads personalization"? My prediction is "close to 0%". Google's "About" page states: "Our mission is to organise the world’s information and make it universally accessible and useful". No mention of personalization involved. Therefore, Google is NOT known for ads personalization.
- dennisgorelik 8y ago
  A correct question to "100 random people" would be "Does Google do ads personalization". My guess is that 70 people would not even know what "ads personalization" is. Out of remaining 30 people, 28 would correctly claim that Google does ads personalization.

amluto 8y ago

The top of the CNIL site literally says: > If you continue to browse this website, you accept third-party cookies used to offer you videos, social sharing buttons, contents from social platforms. That looks like an illegal opt out. They should fine themselves :)

mehrdadn 8y ago
Yeah... how does that work? Are they really this blind to what they themselves are doing?
- maaaats 8y ago
  Do you think whatever cookie they may set can be compared to the personal data google has on you? The world isn't black and white.
readyp1 8y ago
If you look just to the right of that statement, there's a button labeled Personalize that lets you set which 3rd party services you consent to. Correct me if I'm wrong, but that appears compliant...
- michaelmrose 8y ago
  Why can't we just set a single setting and have every website obey it?
  - amaccuish 8y ago
    It's called Do-Not-Track and was ignored...
    - mehrdadn 8y ago
      If GDPR required websites to obey DNT would it still be ignored?

alkonaut 8y ago

Hope they go after one of the ”cookiebot”-type splash sites next. What I mean is those that only have ”consent” or “leave”. It’s a clear violation of the GDPR and yet tons of sites do it.

tzs 8y ago
Will going after those sites actually accomplish much? They'll just add a third option, "pay", which lets you buy access without them storing personal information (other than information they need to recognize paid users, of course). Almost no one will actually pick the "pay" option, so for most practical purposes it effectively reduces to either "consent" or "leave".
- alkonaut 8y ago
  I'd be perfectly happy to see what effectively is 3 optionsn "pay with money" "pay with info" or "leave". Whether or not people choose the same option anyway doesn't matter, it's now a much more informed choice than before as it's obvious how much your information is actually worth. Also, sites that can't be bothered to set up premium/paid access mihgt do go the LA Times route and block access in Europe which I also think is completely OK.

gnode 8y ago

Although 50M EUR is a minor fine for a corporation the size of Google, this goes beyond a "warning in writing in cases of first and non-intentional non-compliance". Does this mean that Google has been previously given such a warning and violated it, or that they've been judged to have intentionally not complied?

ddebernardy 8y ago

50M EUR seems like a rounding error. Isn't Google earning over 30Bn USD per quarter?

DeonPenny 8y ago
Not if it's just profit from europe
- ddebernardy 8y ago
  Even then, if you assume Europe is somewhere between a 4th and a 3rd of their total revenue - which I'd expect it to be, given how the EU is a larger economy than the US and Google is even more dominant in Europe than in the US, and irrespective of ad budgets being traditionally lower than in the US - it seems tiny.

Animats 8y ago

For Google, this is small. Remember when they had to pay US$500M to the US DOJ for knowingly assisting in pushing drugs?[1] [1] https://www.wired.com/2013/05/google-pharma-whitaker-sting/ https://www.wired.com/2013/05/google-pharma-whitaker-sting/

amriksohata 8y ago

The EU is bringing a copyright law in soon, who knew the EU would be the one bringing down the internet

buboard 8y ago

This is how you weaponize legislation. I 'll be damned if "They are going after the big guys". Just reading the ruling tells you that any DPA can come up with any kind of justification if they have a beef against you. Not only the law is vague, now they can fine our businesses because we have "buttons and links on which it is required to click to access complementary information". And this is only the DPA of France. There are much more corrupt governments and officials across EU countries. Romania is already having some fun with it. Good luck to everyone , but i m expecting this to backfire spectacularly in the medium term.

alt_f4 8y ago

These fines are really just a way for European govts to claw back money which they feel they are owed by American tech companies for being successful in European markets. In a global world, that's a wrong way to look at things. It is time to cut admin fat in EU govts and stop penalizing productive businesses.