On May 28 2018, La Quadrature du Net, on behalf of 12 000 people, filed five complaints before the CNIL (the French Data Protection Authority) against Google, Apple, Facebook, Amazon and Microsoft. In the meantime, the CNIL decided it was qualified to handle the complaint against Google, while other complaints were directed before the Irish and Luxembourg authorities. Another complaint was submitted before the CNIL against Android by our friends of the Austrian association noyb.
Today, the CNIL sanctioned Google to a 50 million Euros fine, stating that the targeted advertising it engages in with its operating system Android is in breach of the GDPR, the new European regulation that came into effect on May 25. However, this sanction is really only the beginning of an answer to our complaint against Google, which denounced especially the targeted advertising imposed on Youtube, Gmail and Google Search in violation of our consent.
Furthermore, regarding the substance of the decision, the CNIL has sanctioned Android on the basis of rather low-stake arguments: it considers, rightly, that the information Google provides when creating an account is not clearly accessible and that our consent is not explicitly obtained (with a positive act on our part) but, notably, using pre-ticked boxes, which is explicitly prohibited by the GDPR.
Admittedly, this last argument was indeed one of those we raised in our complaints, but our complaints were primarily intended to settle another, much more fundamental debate: for the CNIL to recognise that our consent is only valid when it is freely given . For the CNIL to clearly state that Google can not force us to accept its targeted advertising in order to use its services.
In contrast to the its recent decisions about French companies, the CNIL is today fully silent on this subject, which we deeply regret. We expect these issues will be addressed in its forthcoming decisions about Youtube, Gmail and Google Search.
In conclusion, while we welcome this first sanction based on our collective complaints, especially because this decision cuts short Google’s attempted escape to Ireland, we mainly expect from the CNIL to issue as soon as possible its next decisions. These will have to address the issue of “freely given consent” and provide for a sanction that is proportionate to the situation, well beyond 50 million euros.
Lastly, we would like to extend a warm thank you to the 12 000 people with whom we lodged these complaints against the GAFAM and the world they stand for <3