Google has been given a 50 million Euro fine in France over data protection failures, particularly focusing on how it processed personal data for advertising services.
CNIL, the French commission for monitoring abuses of data privacy laws claims that Google has not obtained valid authorization to use people's data. It claims that the information people need to make informed choices is hidden in complex agreements and that is "diluted in several documents and does not enable the user to be aware of their extent".
The commission also says that Google's information on advert personalization doesn't offer clarity over how and where there data is used on its services. Those might include YouTube, Google Search, Maps, Google Play and other services.
CNIL accepts that users can modify options and configure the display of adverts. However, it also says that doesn't mean that GDPR is respected.
Crucially, the options to change ad personalization are hidden and ticked by default - which goes against the GDPR requirement that consent is given in a clear, unambiguous way.
For example, under GDPR users must tick a box that enrolls them in an email newsletter, rather than untick a box.
"The infringements deprive users of essential guarantees regarding processing operations that can reveal important parts of their private life since they are based on a huge amount of data" the regulator said.
The fine, while large, is certainly not the largest Google has recieved. In 2018 the company was handed a landmark £3.8 billion fine by the EU over "serious illegal behaviour".
In that case the EU claimed that Google was abusing its market dominance by demanding phone manufacturers offered its web browser and search service on their devices or they would be denied access to the Google Play Store.
Google's shopping service was also accused of distorting the market in 2017 and fined £2.1 billion.
A Google spokesperson told Mirror Online "People expect high standards of transparency and control from us. We’re deeply committed to meeting those expectations and the consent requirements of the GDPR. We’re studying the decision to determine our next steps".
