The French data protection agency (CNIL) has fined TikTok UK and TikTok Ireland €5,000,000 for making it difficult for platform users to disable cookies and not adequately informing them about their purpose. This design behavior was found to violate Article 82 of France’s data protection laws (DPA), a national regulation that corresponds to the provisions of the GDPR (General Data Protection Regulation) applicable across Europe.

The €5m fine was determined by the severity of the breaches, including the number of people affected, including children, and the number of times CNIL had to repeat its warnings to TikTok about the need to comply with French data protection law.

Instead, the CNIL says users will need to make multiple targeted clicks to disable all cookies, which was disappointing and naturally resulted in most visitors to TikTok clicking the “Accept All” button.

Article 82 of the French DPA not only requires the provision of services to obtain users’ consent for the storage of cookies, but also provides users the freedom to grant this consent. As a result, the cookie consent dialog should offer a balanced approach to how options are presented to the user, which is not the case with TikTok sites.

Despite repeated warnings from CNIL, it took until February 2022 for TikTok to implement the “Deny All” button and prominently place it in the cookie consent request.

The second violation, which is also a violation of Article 82 of the DPA, is insufficient disclosure of the purpose of cookies in the banner. The CNIL says that users who click the banner link to learn more still don’t get enough details about the purpose of the cookies.

It’s worth noting that aggressive data collection strategies are common among major online platforms where the CNIL has recently imposed heavy fines such as $8.5 million to Apple, $68 million to Facebook and $170 million to Google.

A TikTok representative posted the following comment to BleepingComputer regarding the CNIL penalty:

“These findings relate to past practices we reviewed last year, including making it easier to disable unnecessary cookies and providing more information about the purpose of certain cookies. CNIL highlighted our collaboration during the investigation, and user privacy remains a top priority for TikTok.”