Privacy & Information Security Law Blog

On January 12, 2023, the French Data Protection Authority (the “CNIL”) announced a €5,000,000 fine for the social network TikTok for violations of applicable cookie rules. The fine was imposed at the end of 2022.

Background

The CNIL carried out several investigations of TikTok’s website (but not its mobile app) between May 2020 and June 2022. Following these investigations, the CNIL concluded that TikTok Information Technologies UK Limited and TikTok Technology Limited had failed to comply with the obligations set out in Article 82 of the French Data Protection Act.

The CNIL’s Decision and Sanctions

Although the TikTok companies offered users a button allowing them to immediately accept the use of cookies, the CNIL determined that they did not allow users to reject cookies as easily: in practice, several clicks were required for users to refuse all cookies. Accordingly, the CNIL determined that the consent refusal mechanism offered by TikTok discouraged users from refusing cookies and instead encouraged them to accept all cookies for the sake of convenience. In light of this, the CNIL considered that users’ consent was not freely given and TikTok had therefore infringed Article 82 of the French Data Protection Act. In addition, the CNIL found that users were not sufficiently informed about the purposes of the cookies used, neither in the first-layer cookie banner nor through the cookie consent tool linked to in the banner.

According to the CNIL, the amount of the fine is justified by the number of data subjects in France affected, including minors, and the CNIL’s numerous prior communications about offering users an easy way to reject cookies.

The CNIL’s Jurisdiction

The CNIL considered itself competent to review the use of cookies placed on the terminals of users located in France. In addition, the CNIL asserted that it has authority to investigate TikTok’s cookie practices under the e-Privacy Directive, which is transposed into national law by Article 82 of the French Data Protection Act.

Read the decision (in French) and the press release (in English and in French).