Skip to main contentMicrosoft Bing: check whether refusal takes more work than acceptance
You can compare the work needed to accept or refuse cookies. CNIL’s 2022 Microsoft case also covers cookies with more than 1 purpose.
Case record
| Fact | Record |
|---|---|
| Authority | CNIL, France’s data protection authority |
| Entity | Microsoft Ireland Operations Limited |
| Jurisdiction and law | France · French Data Protection Act, Article 82 |
| Action | Cookie sanction, with a later decision about the injunction |
| Sanction adopted | 19 December 2022 |
| Decision published | 22 December 2022 |
| Amount | EUR 60 million administrative fine |
| Later decision | 11 May 2023 · specific injunction satisfied within its deadline |
| Source review | 16 October 2026 |
CNIL’s December 2022 newsletter names Microsoft. The published decisions now use an anonymised company name. This case concerns Article 82, not a GDPR fine. CNIL newsletter · Decision SAN-2022-023
What happened
CNIL imposed a EUR 60 million fine on 19 December 2022. Its newsletter identifies unequal work to refuse and accept cookies as a reason for the sanction. CNIL newsletter
On 11 May 2023, CNIL found that the company met the specific injunction deadline. It did not impose the additional daily penalty. That decision concerns the injunction, not all current cookie uses. Decision SAN-2023-007
Technical behaviour
The 2022 decision addresses a cookie with several purposes. One purpose was to control ad fraud. CNIL found that this purpose needed consent. Decision SAN-2022-023, paragraphs 49–54
CNIL also found that the refusal process discouraged refusal. Decision SAN-2022-023, paragraph 63 onwards
Inth’s technical interpretation: a cookie name or an essential-purpose label cannot establish every use of that cookie. The interface needs a separate test for the work that each choice demands.
Checks for your own systems
In the repository
- List each purpose for each cookie or identifier.
- Find code paths that use the same cookie for different purposes.
- Trace refusal to each affected script and data use.
- Check whether an essential-purpose label hides another use.
In the browser and network
- Compare acceptance and refusal from fresh sessions.
- Record the steps, screen labels, and errors for each choice.
- Check cookie writes and reads before a choice.
- Repeat the check after refusal and consent withdrawal.
With the people responsible for data use
- Ask the data owner to justify each claimed consent exemption.
- Compare the full purpose list with the cookie notice.
- Keep a dated record of the interface and test results.
Sources and limits
Source review: 16 October 2026. CNIL no longer publishes the original named news article. The newsletter preserves the name.
The decisions explain the legal basis in French.
This review does not establish payment or every later appeal. It does not audit the current Bing interface. The 2023 follow-up concerns the specific injunction.
Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract. Browser captures cannot show all server operations.
Related: SHEIN and cookie controls · Honda and unequal choices.