Deliberation of the Restricted Committee concerning Google LLC and Google Ireland Limited

€150 million in fines


Google LLC and Google Ireland Limited required users to go through several steps to refuse cookies, and for not providing a “refuse all” button in the first layer of the cookie notice.

Our analysis

The hard to cancel pattern was used by Google, making it easy for users to accept all cookies immediately on the first step of the cookie information notice, but requiring several steps to refuse cookies. CNIL found that this practice violated Article 5(3) of the ePrivacy Directive, which requires clear and comprehensive information on the purposes of cookies and the ability to refuse them. Google also used false hierarchy by presenting the “Accept all” option more prominently than the “Reject” option. This made it seem like accepting cookies was the default and expected option, while refusing them was a secondary, less important choice. The CNIL found this to be a violation of Article 82 of the French Data Protection Act, which requires clear and explicit consent for data processing activities. The practice of Obstruction can be seen as making it unnecessarily complex for users to exercise their right to refuse cookies. The company required users to go through several layers of information and additional steps to refuse cookies, making it harder for them to opt-out. This practice also violated Article 82 of the French Data Protection Act, which requires that users can easily exercise their rights under the law.


CNIL’s restricted committee decided to impose an administrative fine of €90,000,000 on Google LLC and €60,000,000 on Google Ireland Limited for violating Article 82 of the French Data Protection Act. Additionally, the committee issued an injunction against both companies to modify the methods of obtaining user consent on and websites. The companies were required to provide users with a means of rejecting the operations presenting simplicity equivalent to the mechanism provided for acceptance in order to guarantee the freedom of their consent.


Google LLC & Google Ireland Ltd.

Case number


Related deceptive patterns

Related laws

Legal enforcement database by Leiser, Santos and Doshi

The information about laws and cases on this website is brought to you by the Leiser, Santos and Doshi enforcement database.

About us