CNIL

The CNIL's largest cookie penalty against Google covered advertising inserted directly into Gmail inboxes without consent, alongside continued cookie-consent failures.

The CNIL found that Google made refusing cookies far harder than accepting them, a dark-pattern design that did not amount to valid consent.

The CNIL fined Google for placing advertising cookies on users' devices without prior consent and without adequate information.

The CNIL fined Microsoft for depositing advertising cookies on bing.com without consent and for making it harder to refuse cookies than to accept them.

France's CNIL issued one of the first major GDPR fines, finding that Google lacked transparency and valid consent for ads personalisation during Android device setup.

The CNIL fined Amazon for placing advertising cookies on amazon.fr visitors' devices without consent or adequate information.

The CNIL found that Free Mobile's security was inadequate for the volume and sensitivity of its data, with weak authentication on the VPN used for remote work and ineffective detection of abnormal activity, after an attacker reached its systems in October 2024. It also found that the breach notice sent to subscribers lacked required information, and that Free Mobile kept millions of former subscribers' records for an excessive period.

The CNIL found that Free, the broadband operator, did not secure its subscribers' data to a level matching its volume and sensitivity, with weak VPN authentication and ineffective detection of abnormal activity, after an attacker reached the systems of Free and Free Mobile in October 2024. It also found that the breach notice sent to subscribers lacked required information on the consequences and on how to protect themselves.