Sanctions on Google and Amazon by France’s data protection Regulator

France’s data protection regulator-imposed fines for two breaches of Article 5(3) of the Directive 2002/58 / EC
of the European Parliament (e-privacy directive) and Article 82 of the Data Protection Act.
1. Deposit of cookies without obtaining the prior consent of the user
Article 5(3) of the e-privacy directive and Article 82 of the Data Protection Act provide that any action to access
or register information in the user's computer, with some exceptions, can only take place after the user has
expressed his consent.
When a user visited one of the pages of the website amazon.fr, a large number of cookies used for advertising
purposes were automatically placed on his or her computer without requiring any action on his or her part. By
automatically placing cookies on the terminals of Internet users located in France going to the Amazon.fr site,
the company necessarily prevents users from validly expressing their consent. This is a violation of Article 82 of
the Act.
2. Lack of information provided to the users of the website amazon.fr
Article 5(3) of the e-Privacy directive and article 82 of the Data Protection Act provide that the user must be
fully informed of the purposes of storage and reading operations of the cookies and the means available to the
user to oppose these cookies.
In the case of a user visiting the website amazon.fr, the information provided was neither clear, nor complete
and only contained general information regarding the purposes of all the cookies placed. It was not made clear
to the user that the cookies placed on his or her computer were used to display personalized ads. The banner also
did not give user the option to refuse these cookies. This was held to be a violation of Article 82 of the Act.