Excerpt
CNIL found Amazon guilty of depositing cookies without prior consent and the failure to inform users about depositing cookie or the means to refuse them.
Our analysis
The CNIL discovered that Amazon.fr was placing a large number of cookies for advertising purposes on users' computers without their consent when they visited the site. The CNIL deemed this action to be a violation of the obligation to obtain user consent before depositing cookies, as these cookies were not essential to the service. The banner displayed on the Amazon.fr site was also found to be inadequate in informing users residing in France beforehand and clearly about the deposit of cookies, their objectives, and how to refuse them. Moreover, when users visited Amazon.fr after clicking on an advertisement published on another website, the same cookies were deposited without any banner being displayed. The CNIL found that Amazon committed two violations of Article 82 of the Data Protection Act by depositing cookies without prior consent and failing to inform users.
Outcome
The CNIL has levied a fine of 35 million euros on AMAZON EUROPE CORE. The fine is a result of the company's placement of advertising cookies on the computers of users of the Amazon.fr sales site without obtaining their prior consent or providing sufficient information about the use of cookies.
Parties
La Quadrature du Net through CNIL and Amazon Europe Core
Case number
Commission File No. 000-22513
Decision
Related deceptive patterns
Sneaking involves intentionally withholding or obscuring information that is relevant to the user (e.g. additional costs or unwanted consequences), often in order to manipulate them into taking an action they would not otherwise choose.
Forced action involves a provider offering users something they want - but requiring them to do something in return. It may be combined with other deceptive patterns like sneaking (so users don't notice it happening) or trick wording (to make the action seem more desirable than it is). Sometimes an optional action is presented as a forced action, through the use of visual interference or trick wording. In cookie consent interfaces, forced action is sometimes carried out through "bundled consent". This involves combining multiple agreements into a single action, and making it hard or impossible for a user to selectively grant consent.
Related laws
Users must give informed and unambiguous consent and receive clear information about cookies, including processing purposes and data controller identity, according to the law.