Google and Amazon have both been hit with substantial fines from the French data-protection regulator, CNIL, for invading users’ privacy.

On Thursday, the watchdog fined Google €100 million ($121 million)—double the penalty it levied on the firm last year over Android privacy violations—and Amazon €35 million. Crucially, it has also ordered them to start clearly telling users why they track them.

In both cases, CNIL said the companies had illegally deposited tracking cookies in users’ browsers without their prior consent, while failing to clearly disclose to the users it was leaving the cookies in order to show them personalized ads.

Google sinned further. “When a user deactivated the ad personalization on the Google search by using the available mechanism…one of the advertising cookies was still stored on his or her computer and kept reading information aimed at the server to which it is attached,” CNIL said in a statement.

“Therefore, the restricted committee considered that the ‘opposition’ mechanism set up by the companies was partially defective, breaching Article 82 of the French Data Protection Act.”

Changing ways

Both Google and Amazon have already taken steps to fix the problems. However, CNIL wants to see more and has warned the Big Tech firms that they face further fines if they don’t act quickly.

In September, both companies stopped automatically leaving advertising cookies on the devices of visitors to their French sites. But, CNIL said, they still don’t explicitly tell their French users how the cookies will be used and that they can refuse them.

Google and Amazon now have three months in which to get in line with CNIL’s demands, otherwise they will face daily fines of €100,000.

In a statement, Amazon said it disagrees with CNIL’s decision, countering it fully complies with “all applicable laws.” However, it did not indicate its next steps in this case.

“We stand by our record of providing upfront information and clear controls, strong internal data governance, secure infrastructure, and above all, helpful products,” a Google spokesperson said in a statement.

“Today’s decision under French e-Privacy laws overlooks these efforts and doesn’t account for the fact that French rules and regulatory guidance are uncertain and constantly evolving. We will continue to engage with the CNIL as we make ongoing improvements to better understand its concerns.”

Rising tensions

CNIL has long been one of Europe’s most aggressive data protection regulators, but these fines come at a time of notable tension between the French authorities and Big Tech.

Frustrated with a lack of progress in international tax-reform discussions, President Emmanuel Macron’s government is pressing ahead with a “digital services tax” on the French revenues of the biggest online beasts, which tend to be American. Amazon is one of the companies it is known to have ordered to pay the new tax for the current year.

Both Google and Amazon are also in the EU’s crosshairs over potentially anticompetitive behavior.

The European Commission’s competition division last month charged Amazon over its alleged misuse of third-party merchants’ data in France and Germany. It claimed Amazon breaks competition law by using the data to “calibrate [its] retail offers and strategic business decisions to the detriment of the other marketplace sellers.”

The EU regulator, which has already fined Google more than $9 billion for antitrust violations, is also due to say this week whether the company’s takeover of wearables firm Fitbit can go ahead, and under what conditions.