France's data protection authority has fined Google and Facebook millions.
On their pages, users would not have been able to refuse cookies as easily as they could accept, according to the Cnil statement published on Thursday.
Two Google subsidiaries should therefore pay a fine of 150 million euros together.
On Facebook it is 60 million euros.
It is the highest penalty the DPA has ever imposed.
Cookies are small data sets that are stored on the device when you visit a website.
It makes a lot of things easier, but personal information can also be transmitted transparently to advertisers.
The Cnil complained that on the google.fr, facebook.com and youtube.com pages, cookies could be accepted with just one click, but several clicks were necessary to reject them.
On Facebook, you even have to click on a field that says "accept cookies" and is therefore misleading to switch off.
This affects the freedom of consent and violates French law.
The platform operators now have three months to adjust their handling in France.
For each day of delay, 100,000 euros would be due.
A spokeswoman for the Facebook parent company Meta said they were looking at the authority's decision.
The own cookie settings would give people more control over their data.
These attitudes will be further developed and improved.
Google announced that it is aware of its responsibility to people's trust and is committed to further changes.