February 1, 2023

Volume XIII, Number 32

Advertisement

January 31, 2023

Subscribe to Latest Legal News and Analysis

January 30, 2023

Subscribe to Latest Legal News and Analysis

CNIL Fines TikTok 5 Million Euros Over Cookie Infringements

On January 12, 2023, the French Data Protection Authority (the “CNIL”) announced a €5,000,000 fine for the social network TikTok for violations of applicable cookie rules. The fine was imposed at the end of 2022.

Background

The CNIL carried out several investigations of TikTok’s website (but not its mobile app) between May 2020 and June 2022. Following these investigations, the CNIL concluded that TikTok Information Technologies UK Limited and TikTok Technology Limited had failed to comply with the obligations set out in Article 82 of the French Data Protection Act.

The CNIL’s Decision and Sanctions

Although the TikTok companies offered users a button allowing them to immediately accept the use of cookies, the CNIL determined that they did not allow users to reject cookies as easily: in practice, several clicks were required for users to refuse all cookies. Accordingly, the CNIL determined that the consent refusal mechanism offered by TikTok discouraged users from refusing cookies and instead encouraged them to accept all cookies for the sake of convenience. In light of this, the CNIL considered that users’ consent was not freely given and TikTok had therefore infringed Article 82 of the French Data Protection Act. In addition, the CNIL found that users were not sufficiently informed about the purposes of the cookies used, neither in the first-layer cookie banner nor through the cookie consent tool linked to in the banner.

According to the CNIL, the amount of the fine is justified by the number of data subjects in France affected, including minors, and the CNIL’s numerous prior communications about offering users an easy way to reject cookies.

The CNIL’s Jurisdiction

The CNIL considered itself competent to review the use of cookies placed on the terminals of users located in France. In addition, the CNIL asserted that it has authority to investigate TikTok’s cookie practices under the e-Privacy Directive, which is transposed into national law by Article 82 of the French Data Protection Act.

Read the decision (in French) and the press release (in English and in French).

Copyright © 2023, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XIII, Number 23
Advertisement
Advertisement
Advertisement

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct
Advertisement
Advertisement
Advertisement