France Penalizes Microsoft with $64 Million Fine for Unauthorized Use of Advertising Cookies

France's privacy watchdog has fined Microsoft Corp. for violating the country's data privacy laws. Microsoft has been ordered to pay a fine of 150,000 euros.

The European Commission has fined Microsoft €5 million for not making it easy enough for users of its Bing search engine to reject cookies used for online ads. This is part of a broader increase in enforcement of Europe’s privacy laws.

France’s data-protection regulator, the CNIL, said Thursday that it fined a Microsoft subsidiary in Ireland 60 million euros, equivalent to almost $64 million. The company hadn’t—until earlier this year—offered users the option to reject so-called cookies alongside the button to accept them, the regulator said. Cookies are a type of digital identifier that websites can leave in web browsers, and which are often used to help target advertising.

The regulator has ordered Microsoft to seek consent for another type of cookie that it places in web browsers for the purposes of detecting fraudulent views of ads. The CNIL said that this wasn't necessary to make the search engine function, and if Microsoft doesn't comply within three months, it could face additional fines of €60,000 a day.

A Microsoft spokesman said that the company had made changes to its cookie practices to add a reject button for advertising cookies, but that it remained concerned with the CNIL's position on advertising fraud. The company argued that such cookies shouldn't require consent by those intending to defraud others, he said. Microsoft hadn't decided whether to appeal the part of the decision that ordered it to seek consent for the cookie used to detect ad fraud, the spokesman said.

The CNIL's fine on Thursday is part of a broader effort by the French regulator to pursue big tech companies and online publishers to force them to make reject buttons as prominent as those to accept online cookies when they relate to targeted advertising. Many regulators in the European Union don't regard targeted ads as necessary for the functionality of a website.

Earlier this year, the CNIL fined Alphabet Inc.'s Google €150 million and Meta Platforms Inc.'s Facebook €60 million over the same issue. Both Google and Facebook have now implemented a button to reject nonessential cookies next to the one to accept them when visitors first land on their home pages.

Regulators in Europe have been taking a tough stance against big tech companies and their handling of user data in recent years. In particular, EU regulators have been cracking down on targeted advertising based on users’ online activity. A body representing all EU privacy regulators recently ruled that Ireland’s data watchdog must order Facebook and Instagram to stop making personalized ads based on users’ activity a condition of using the services.

Many privacy cases against tech companies under the EU’s General Data Protection Regulation (GDPR) are handled by Ireland’s Data Protection Commission. This is because many U.S. tech companies have their headquarters in Ireland. However, France’s CNIL has been able to take on the cookie-consent issue because it is governed in part by an older EU law, the ePrivacy directive. This directive does not include the same provisions to shift investigations to the country where the company in question is based.