Excerpt
Google LLC and Google Ireland Limited required users to go through several steps to refuse cookies, and for not providing a “refuse all” button in the first layer of the cookie notice.
Our analysis
The hard to cancel pattern was used by Google, making it easy for users to accept all cookies immediately on the first step of the cookie information notice, but requiring several steps to refuse cookies. CNIL found that this practice violated Article 5(3) of the ePrivacy Directive, which requires clear and comprehensive information on the purposes of cookies and the ability to refuse them. Google also used false hierarchy by presenting the “Accept all” option more prominently than the “Reject” option. This made it seem like accepting cookies was the default and expected option, while refusing them was a secondary, less important choice. The CNIL found this to be a violation of Article 82 of the French Data Protection Act, which requires clear and explicit consent for data processing activities. The practice of Obstruction can be seen as making it unnecessarily complex for users to exercise their right to refuse cookies. The company required users to go through several layers of information and additional steps to refuse cookies, making it harder for them to opt-out. This practice also violated Article 82 of the French Data Protection Act, which requires that users can easily exercise their rights under the law.
Outcome
CNIL’s restricted committee decided to impose an administrative fine of €90,000,000 on Google LLC and €60,000,000 on Google Ireland Limited for violating Article 82 of the French Data Protection Act. Additionally, the committee issued an injunction against both companies to modify the methods of obtaining user consent on google.fr and youtube.com websites. The companies were required to provide users with a means of rejecting the operations presenting simplicity equivalent to the mechanism provided for acceptance in order to guarantee the freedom of their consent.
Parties
Google LLC & Google Ireland Ltd.
Case number
SAN-2021-023
Decision
Related deceptive patterns
Hard to cancel (aka "Roach Motel") is a deceptive pattern where it is easy to sign up for a service or subscription, but very difficult to cancel it. This typically involves hiding the cancellation option, requiring users to call customer services to cancel, and making the cancellation process overly complex and time-consuming. This can cause users to give up trying to cancel, and continue paying for the service for a longer period.
There are numerous ways to interfere with the visual design of a page to hide, obscure or disguise information. Visual perception can be manipulated by using small, low contrast text. Comprehension can be manipulated by creating a chaotic or overwhelming interface. User's expectations can be violated by placing important information in styles or location they would not expect.
Obstruction is a type of deceptive pattern that deliberately creates obstacles or roadblocks in the user's path, making it more difficult for them to complete a desired task or take a certain action. It is used to exhaust users and make them give up, when their goals are contrary to the business's revenue or growth objectives. It is also sometimes used to soften up users in preparation for a bigger deception. When users are frustrated or fatigued, they become more susceptible to manipulation.
Related laws
Users must give informed and unambiguous consent and receive clear information about cookies, including processing purposes and data controller identity, according to the law.
Requires website operators to obtain user consent before storing or accessing information on the user's device through cookies or similar technologies.