Microsoft Ireland Operations

What happened

The CNIL fined Microsoft €60 million for depositing advertising cookies on users' devices via bing.com without obtaining prior consent. The investigation found that when users visited the Bing search engine, advertising cookies were automatically placed without any consent mechanism being presented first. Microsoft failed to implement a proper cookie consent banner, meaning cookies were set before users had any opportunity to accept or refuse them. The CNIL also noted the absence of an easy-to-use refusal mechanism. Microsoft was ordered to stop depositing cookies without consent within three months or face a penalty of €60,000 per day of non-compliance.

Articles violated

Lessons learned

Advertising cookies must never be deposited before obtaining user consent — prior consent is a legal requirement, not optional. Search engines and websites must implement consent mechanisms before any non-essential cookies are set. The absence of a cookie banner entirely is a more severe violation than a poorly designed one. Periodic compliance orders with daily penalties create significant ongoing financial pressure to comply.