Google and Amazon fined a total of $163 million for violating French law, after they tracked unsuspecting visitors by placing cookies on their computers

• Google and Amazon in France tracked visitors without permission to personalize ads, a violation of French law. They were fined a total of $163 million on Thursday. 
• “We stand by our record of providing upfront information and clear controls, strong internal data governance, secure infrastructure, and above all, helpful products,” a Google spokesperson told Business Insider via email. 
• “We disagree with the CNIL’s decision,” an Amazon spokesperson told Business Insider. “Protecting the privacy of our customers has always been a top priority for Amazon.”
• Visit Business Insider’s homepage for more stories.

Google and Amazon have been tracking users without permission to serve them ads, a violation of French law, the country’s internet watchdog said as it issued fines totaling $163 million on Thursday. 

Google was being fined $120 million and Amazon $42 million, said the Commission Nationale de l’Informatique et des Libertés (CNIL). The government watchdog said both companies had placed tracking cookies on users’ computers without getting prior consent, then didn’t provide adequate information on how to change cookie settings.  

Both companies defended their practices, saying they aim to give visitors all the information needed to change how they’re tracked online. 

“We disagree with the CNIL’s decision,” an Amazon spokesperson said via email. 

Amazon said: “Protecting the privacy of our customers has always been a top priority for Amazon. We continuously update our privacy practices to ensure that we meet the evolving needs and expectations of customers and regulators and fully comply with all applicable laws in every country in which we operate.”

Google visitors "expect us to respect their privacy, whether they have a Google account or not," a company spokesperson said via email. 

Said the spokesperson: "We stand by our record of providing upfront information and clear controls, strong internal data governance, secure infrastructure, and above all, helpful products. Today's decision under French ePrivacy laws overlooks these efforts and doesn't account for the fact that French rules and regulatory guidance are uncertain and constantly evolving. We will continue to engage with the CNIL as we make ongoing improvements to better understand its concerns."

When CNIL investigators visited google.fr in March, they "found that when a user visited this website, cookies were automatically placed on his or her computer, without any action required on his or her part. Several of these cookies were used for advertising purposes," according to a statement. 

CNIL investigators said Amazon deposited similar cookies when they visited amazon.fr between December 2019 and May 2020. 

Both companies had violated Article 82 of the French Data Protection Act, according to CNIL. Both companies had deposited cookies without "obtaining the prior consent of the user" and also failed to provide "complete" information on how cookies were used, according to statements released on Thursday. 

CNIL took aim at the company's disclaimer text, which for Google said, "Privacy reminder from Google," and for Amazon said, "By using this website, you accept our use of cookies allowing to offer and improve our services. Read more."

Neither text gave visitors a clear way to stop the sites from tracking them, said CNIL. 

Amazon on Thursday said visitors to amazon.fr - as well as other European Union, United Kingdom and Turkish stores - were able to update their cookie preferences "at any time." The company uses cookies to serve ads, of course, they're also there to give shoppers "the essential features" of the Amazon shopping experience, the company said. 

CNIL said Google had a third violation, too. Even after CNIL investigators turned off ad personalization, "one of the advertising cookies was still stored on his or her computer and kept reading information aimed at the server to which it is attached," said CNIL. 

French and European Union cookie regulations have become a moving target, as they've been rewritten over the years, especially in the last 18 months, according to Google. The search giant has ongoing internal discussions about cookies and other visitor tracking, including new upates to regulations, and revises its policies on a rolling basis.

The fines were issued December 7, but announced Thursday. If either Google or Amazon doesn't update its cookie settings within three months, the company would be fined an additional $120,000 for each day it delays, said CNIL.