Google responds to CNIL Cookie Fine – ‘Reject All’ now on equal footing

Google has announced the completion of “a full redesign” of its cookie consent practices and the “infrastructure” it uses to handle cookies. Under this new practice, users of Google search and YouTube in Europe will see a new cookie consent choice window with equal “Reject all” and “Accept all” buttons on the first screen.

Google explained its actions were based on conversations with regulators in a number of EU Member States and the UK, as well as “specific direction from France’s Commission Nationale de l’Informatique et des Libertés (CNIL).”

This reference to CNIL may remind readers of the €150m cookie-related fines issued by CNIL to Google at the end of 2021. These fines were based on Google’s failure, in CNIL’s view, to make it as easy for French users to reject all cookies as it was to accept all cookies on google.fr and youtube.com (see our blog post on this here).

They followed CNIL’s notification to Google in February 2021 that it viewed the ability for users to reject all cookies as easily as accepting them to be a requirement under applicable regulations.

However, Google’s reference in its announcement to the complex infrastructure changes it has had to make to implement this practice suggests that making cookie-related changes may not be as simple as they first appear.

A few other points that may be worth noting from the announcement include:

• these cookie options will only appear for users while signed out of their Google account or in Incognito Mode – however, many users will already have selected their cookie preferences on their Google account. Users can also still choose to customise their cookie choices in more detail though by clicking through the “More options” link;
• the practice is initially being “rolled out” on YouTube, and so it may take a while before all users notice this change; and
• it seems that the UK is within the scope of this policy, which Google is rolling out across “Europe” – the UK is referred to alongside various EU Member States.

In relation to this last point, the ICO released a statement welcoming this action by Google, and commenting “we expect to see industry following Google’s lead to provide clearer choices for consumers”. Although the UK’s cookie rules are under review as part of the government’s general review of data privacy laws (see our blog for more information), this practice accords with the ICO’s current cookie guidance. Similarly to CNIL’s position, the ICO has stated that emphasising the “agree” or “allow” cookie options over the “reject” or “block” cookie options “represents a non-compliant approach” (as the online service is thereby influencing users towards the “accept” option).

CNIL’s fine of Google was announced at the same time as a fine levied against Facebook for similar reasons. Following such high-profile enforcement action and this announcement by Google, it will be interesting to see if this “Reject all cookies” button becomes more widespread market practice (and anecdotally, it is something this author at least is noticing more in website cookie notices).

Finally, it will be interesting to see how enforcement activity in the EU (such as CNIL’s) has an impact in the UK – both in terms of industry practice and regulator guidance or enforcement.