Dutch DPA fines AS Watson for installing tracking cookies without consent

The Autoriteit Persoonsgegevens, the Dutch data protection authority (DPA), imposes a 600,000 euro fine on AS Watson, an international health and beauty retailer.

The company followed visitors on their website using tracking cookies without asking for permission to place these cookies on customers’ devices.

In doing so, AS Watson collected private and personal information of millions of visitors of Kruidvat.nl, a pharmacy and drugstore chain specializing in health and beauty products in the Netherlands and Belgium. The data was then used to create user profiles.

The retailer collected detailed information, including location data, what pages customers visited, what products they added to their shopping basket, and what recommendations they clicked on. For example, the company knew exactly who bought pregnancy tests, contraceptives and medication for ailments.

Due to the nature of the business, AS Watson gathered very sensitive information, which enabled the company to construct very specific and invasive user profiles of people who visited Kruidvat.nl.

Aleid Wolfsen, chairman of the Dutch DPA, explains that companies can use tracking cookies to look into your internet behavior. The GDPR, the European privacy law, only allows this if visitors are informed and consent to this.

“What you do on the internet is very personal. An organization may only keep track of this if you explicitly agree to it. And you should have the ability to opt out of this tracking software without it being detrimental to you,” he says.

Kruidvat.nl should have asked permission to its visitors before installing tracking cookies. Instead, all the boxes on the cookie banner on the website were already checked, which is not allowed. Visitors who still wanted to refuse the cookies had to go through many steps to achieve this. Personal user data was therefore processed unlawfully.

The Dutch regulator launched an investigation back in 2019 to see what websites installed tracking cookies without consent. The privacy watchdog sent a letter to AS Watson, informing the company that Kruidvat.nl didn’t comply with the GDPR.

In April 2020, the Dutch DPA sent another notice. In October 2020 the issue was resolved on the website. Nevertheless the regulator decided to impose a 600,000 euro fine.

“It’s important that people keep control over their personal data when visiting websites. With clear information about the use of cookies, they can make a well-considered choice whether to give permission or not. Therefore, organizations must ensure they implement a cookie banner that meets the legal requirements,” the Autoriteit Persoonsgegevens states.

AS Watson has objected to the fine.

With over 16,500 stores in 28 countries and more than 130,000 employees, AS Watson is the world’s largest retailer in health and beauty products and lifestyle brands.