France's CNIL says Microsoft changed the way the company tracks Bing users; CNIL fined Microsoft €60M in December 2022 and threatened fines of €60K per day
Context & Ripple Effects
Microsoft is cleaning up its Bing tracking under pressure from France's data regulator, which fined the company €60M in December 2022 and kept a €60K-per-day penalty on the table until it complied. The change confirms CNIL's playbook works: the same regulator had already hit Google with $120M and Amazon with $42M for placing tracking cookies without consent in 2020, then fined Google €150M and Meta €60M for making it hard for French users to reject trackers.
For Microsoft this is also a sequel. The CNIL served the company formal notice over Windows 10 privacy failings back in 2016, so Bing tracking was a repeat encounter between the same two parties — and unlike 2016, the resolution came via a paid penalty plus verified behavioral change rather than a deadline.
First-order effects
- Microsoft has changed the way it tracks Bing users in France, closing out the exposure created by the €60M fine and neutralizing the threat of accumulating €60K daily penalties.
Second-order effects
- Google and Meta, already fined by CNIL for identical consent-flow failures, now face the same bar: demonstrated tracking changes, not promises, or risk the escalating per-day structure CNIL applied to Microsoft.
Third-order effects
- If CNIL keeps pairing headline fines with daily-rate pressure until behavior actually shifts, cookie-consent enforcement across the EU moves from episodic punishment to continuous compliance auditing — raising the operating cost of dark-pattern consent flows for every large ad platform.
The trend: European regulators are shifting from issuing record GDPR fines to verifying that targeted companies actually restructure their tracking, turning consent penalties into an ongoing compliance regime.