DECISION SUMMARY
What happened
On 6 January 2022, the Commission Nationale de l'Informatique et des Libertés (CNIL) imposed sanctions totalling €150 million on Google LLC and €90 million on Google Ireland Limited, with a parallel €60 million sanction against Facebook Ireland Limited (now Meta Platforms Ireland). The aggregate €300 million enforcement day was the largest in CNIL history at the time and is the leading authority on cookie-banner user-interface obligations in the EU.
The complaints originated with individual users and the French digital-rights NGO La Quadrature du Net, who reported that the cookie banners on google.fr, youtube.com and facebook.com (in their then-current versions) did not allow users to refuse cookies as easily as accept them. The first-screen design typically offered a prominent "Accept all" button. The refusal path required either clicking "Manage settings" or "Customise" to reach a second screen, then making multiple per-category selections, then confirming. The structural asymmetry between accept and refuse was the central issue.
The decision is significant because it applies the ePrivacy Directive (and its French implementing law) rather than the GDPR itself, though the substantive concept of consent is shared. Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended by Directive 2009/136/EC) requires that storing information on, or accessing information from, a user's terminal equipment requires the user's consent. Article 4(11) GDPR defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement". The CNIL's analysis is that consent cannot be freely given where refusing requires materially more user effort than accepting.
What the CNIL found
The CNIL conducted a documented walkthrough of the Google cookie banner UX. On google.fr, it found that the first screen offered "Accept all" as a single-click action, but no equivalent "Reject all" option. To refuse all cookies, a user had to click "More options", then navigate to a second screen with multiple per-category toggles (default on for most), then deselect each toggle, then click "Confirm". The asymmetry was stark: accept all was one click; refuse all required at least four interactions across two screens. The CNIL found this design did not satisfy the freely-given requirement of consent.
A secondary finding addressed the youtube.com banner, which had a similar architecture. The decision treated google.fr and youtube.com as separate processing operations subject to separate sanctions, justifying the two-entity sanction structure (Google LLC for google.fr, Google Ireland for youtube.com).
The CNIL also addressed the proportionality of its sanction. It noted the considerable user base affected (tens of millions of French users), the duration of the infringement (continuing from at least early 2020), the financial advantages drawn by Google from advertising revenue dependent on cookie-based tracking, and the failure of Google to address the design issue notwithstanding warnings from the CNIL and from the EDPB Guidelines 05/2020 on consent (which explicitly identified asymmetric accept/refuse UX as non-compliant).
The injunction component
Alongside the financial sanction, the CNIL issued an injunction requiring Google to provide French users with a refusal mechanism as simple as the existing acceptance mechanism, within three months of the decision notification. The injunction was accompanied by a penalty of €100,000 per day of delay. Google complied within the three-month period by rolling out a revised banner with "Reject all" alongside "Accept all" on the first screen.
Why this case matters
The "refuse as easily as accept" principle has now been adopted as a baseline standard for cookie banners across the EU and the UK. The CNIL applied it to Google and Facebook in January 2022, to Amazon (€35 million, December 2020), to Microsoft (€60 million, December 2022), and to several smaller controllers. The German federal regulator, the Spanish AEPD and the Italian Garante have endorsed the same standard in their own enforcement.
The practical consequence for controllers is concrete: a cookie banner must offer a refusal action that is no more burdensome than the acceptance action. In practice, this means either both options on the first screen with equal visual weight, or both options on the first screen with the refusal as the default state. Multi-click refusal paths, hidden refusal options, and dark-patterns favouring acceptance all fall foul of the principle.
The case also illustrates a broader regulatory architecture point. Cookie consent is governed by ePrivacy, which is a Directive (requiring national implementation) rather than a Regulation. Each Member State's data protection authority enforces cookie consent under national law (Article 82 of the French Loi Informatique et Libertés, the UK PECR equivalent, the German Telemedia Act, etc). The proposed ePrivacy Regulation, which would replace the Directive with a directly-applicable instrument harmonised at EU level, has been under negotiation since 2017 and remains pending. Until it is adopted, cookie enforcement is fragmented across 27 Member States, which leaves the CNIL as arguably the most influential single authority because of the scale of its enforcement.