The investigations found that while the US online giants gave French users a single button to immediately accept cookies, there wasn’t an equally simple way for them to decline because “several clicks are required to refuse all cookies”, said the CNIL data privacy watchdog.

According to CNIL, visitors to Facebook, Google’s French homepage, and YouTube were being nudged to say yes. It means they weren’t freely giving their consent and that’s equal to violation of French data protection rules.

The French watchdog fined Google with a €150 million penalty and Facebook with a €60 million fine. The companies were also threatened by daily penalties of €100,000 if they don’t make it simpler for users in France to refuse cookies within three months.

Facebook, already renamed Meta, said it’s reviewing the decision and is committed to working with authorities. The company said.

“Our cookie consent controls provide people with greater control over their data, including a new settings menu on Facebook and Instagram where people can revisit and manage their decisions at any time, and we continue to develop and improve these controls.”

Google added:

“People trust us to respect their right to privacy and keep them safe. We understand our responsibility to protect that trust and are committing to further changes and active work with the CNIL in light of this decision”.

Google, Facebook and regulators in Europe and the U.S. work on phasing out more egregious data collection practices. That means The French penalty underscores a broader shift in the digital ad industry

Google has also announced plans to phase out so-called third-party cookies used by advertisers from its Chrome browsers, though it will still be able to track users of its own services.

• Improving security to missile-proof level. Yes, customers’ data, identities, and money are not a minor thing, and they are at risk with every login or transaction. Security bullet-proof is not enough. Hackers won’t quit, but clear and legal guarantees and better security must be offered to clients. If crimes like stealing sensitive data, frauds derived from the malicious use of such data, stealing of money, etc. keep affecting customers, it will be hard to make them jump on-board a digital-only bank. Especially the older generations.
• Getting customers’ trust. Disruptive technology is not easy to digest. Especially when your pension, savings, and money in general, is at risk. Security in the terms we described is totally necessary for customers to trust. To accept technology requires to be trained on it and to clearly understand it; How does it work? What risks do I face? How can I protect myself to avoid risks? What kind of guarantees do I have? Customers rely a lot on the face-to-face interaction at banks; making them accept the transition to banks where everything is managed through computers, smartphones, applications, robots, chatbots, codes, passwords, clicks etc won’t be easy without offering proper guarantees of protection, legal regulation. Not only financial institutions but also governments must be involved.
• Customers’ experience. A transparent, comfortable, and friendly online experience must be offered to customers. Clear guidance must be included to execute the different bank processes customers need. Technology is astonishing. No doubt almost everything can be done through it. But there is a human factor involved that should not be forgotten. Not all customers manage digital tools with the same proficiency level. There should be ways to make them feel protected, supported. It can be really frustrating to try to solve a problem with a bot that just repeats pre-programmed answers.