France's data protection agency issued a 210 million euro ($237 million) fine to Google and Meta on Thursday over user tracking concerns. Both companies made it harder for people to refuse cookie tracking than to accept it, said the Commission Nationale de l'Informatique et des Libertés.
As with all US tech companies operating globally, Meta and Google are subject to local laws around the world. In France this means complying with Europe-wide privacy laws including the General Data Protection Regulation, or GDPR, as well as French national privacy laws. The CNIL has its own set of rules regarding ad trackers, which dictate it should be easy for people to refuse cookie tracking, as well as to reconsider their choice to allow cookie tracking at any time.
"People trust us to respect their right to privacy and keep them safe," said a spokesperson for Google in a statement. "We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision under the ePrivacy Directive."
A spokesperson for Meta said the company is reviewing the CNIL's decision. "Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls," they said.