France’s online privacy regulator has ordered Google and Facebook to cough up some €210 million ($237 million) between them, fining the firms for their questionable use of data-tracking ‘cookies’ on their sites.

The French National Commission on Informatics and Liberty (CNIL) announced the move in a statement on Thursday, saying Google will be made to pay €150 million ($169.5 million) and Facebook another €60 million ($67.8 million) within a period of three months, or else face additional fines of €100,000 ($113,000) per day.

The commission said the way the companies employ ‘cookies’ – small amounts of data generated while users browse websites that can be used to track their activity – “affects the freedom of consent,” as Facebook and Google make it much easier for netizens to authorize that data-tracking than to decline it.

“When you accept cookies, it’s done in just one click,” said Karin Kiefer, who leads the commission’s data protection and sanctions team. “Rejecting cookies should be as easy as accepting them.”

The watchdog added that those practices violated the French Data Protection Act, and ordered the companies to “provide internet users located in France with a means of refusing cookies as simple as the existing means of accepting them, in order to guarantee their freedom of consent.”

Both Google and Facebook issued statements vowing to work with French authorities to sort the issue, though the latter firm insisted its “cookie consent controls provide people with greater control over their data,” disputing the consent issues raised by the CNIL. Google, too, argued that “people trust us to respect their right to privacy and keep them safe,” but nonetheless said it would pursue “further changes” to comply with the order.