Microsoft fined €60 million in France over advertising cookies
Bing.com stored cookies on visitors' machines without their consent
France's privacy watchdog said Thursday that it has imposed a penalty of €60 million ($64 million) against Microsoft over its use of advertising cookies.
The Commission Nationale de Informatique et des Libertés (CNIL) said the US tech giant needs to do a better job in implementing mechanisms to allow users of its search engine to refuse cookies as easily as accepting them.
After receiving a complaint concerning cookies on Bing.com, the regulator conducted several site audits between September 2020 and May 2021, leading to the imposition of a fine against Microsoft.
In the complaint, the regulator was informed that cookies were being saved on the user's computer whenever they signed in to the Bing search engine.
Cookies are text files a browser stores on a system when visiting a website. Although these files are designed to speed up users' web browsing, they can also be used to identify a system and monitor users' online activities without their consent.
Web cookies are often used by third-party advertisers, who can target a user with personalised adverts after seeing the websites they visited.
The French regulator said that after conducting investigations, it had discovered that when users visited the Bing website, cookies were stored on their systems without their consent. These cookies were then used for a variety of purposes, including advertising.
According to the CNIL, the website also lacked a button to make it simple for visitors to reject cookies.
The data watchdog said the fine issued against Microsoft Ireland was appropriate for a variety of reasons, including the sheer volume of customers who were adversely impacted and the potential profits that the company may have indirectly made from the information that was gathered via advertising cookies.
Microsoft Ireland has been given three months to fix the problem or face an additional fine of €60,000 every day if the issue is not resolved.
Microsoft said that it had 'fully cooperated' with the French authority and had already made key adjustments to its cookie policies prior to the CNIL's investigation.
'We continue to respectfully be concerned with the CNIL's position on advertising fraud. We believe the CNIL's position will harm French individuals and businesses by allowing fraud to spread online,' the company said.
The Microsoft penalty continues the trend of CNIL's aggressive regulation.
The CNIL said last year that it would take enforcement action against businesses that disobey the 2018 European Union GDPR data privacy regulation, which mandates that websites get users' consent before installing web cookies.
Earlier this year, CNIL fined Google and Facebook a combined €210 million for making it difficult for users to reject cookie tracking. The watchdog said the google.fr, youtube.com, and facebook.com did not allow the easy refusal of cookies compared to how easy it was to accept them.
As a result, the CNIL's restricted committee issued a €150 million fine against Google, while Facebook was slapped with a €60 million fine.
In 2019, CNIL levied a €50 million fine against Google over alleged breaches of GDPR.