TIK TOK Fined in France

TikTok is the latest tech giant to be schooled by France’s data protection watchdog for breaking rules on cookie consent.

The €5 million penalty announced today by the CNIL relates to a cookie consent flow TikTok had used on its website (tiktok.com) until early last year — in which the regulator found it was not as easy for users to refuse cookies as to accept them — so it was essentially manipulating consent by making it easier for site visitors to accept its tracking than to opt out.

This was the case when the watchdog checked in on TikTok’s process, in June 2021, until the implementation of a “Refuse all” button on the site in February 2022 — which appears to have resolved the matter. (And may explain the relatively small fine levied in this case, along with the number of users and minors affected — as well as the enforcement relating only to its website, not its mobile app.)


Tracking cookies are typically used to serve behavioral advertising but can also be used for other site activity, such as analytics.

“During the check carried out in June 2021, the CNIL noted that while the companies TikTok United Kingdom and TikTok Ireland did offer a button allowing cookies to be accepted immediately, they did not put in place an equivalent solution (button or other) to allow the Internet user to refuse their deposit just as easily. Several clicks were necessary to refuse all cookies, against only one to accept them,” the watchdog notes in a press release [translated from French with machine translation].

“The Restricted Committee considered that making the refusal mechanism more complex actually amounts to discouraging users from refusing cookies and encouraging them to favor the ease of the “Accept all” button,” it added, saying it found TikTok had therefore breached a legal requirement for freedom of consent — a violation of Article 82 of the French Data Protection Act “since it was not as simple to refuse cookies as to accept them”.

In addition, the CNIL found that TikTok had not informed users “in a sufficiently precise manner” of the purposes of the cookies — both on the information banner presented at the first level of the cookie consent and within the framework of the “choice interface” that was accessible after clicking on a link presented in the banner. Hence finding several breaches of Article 82.