Back on Android, my daily life is blissfully bereft of ads, except when I visit somewhere with live TV. It's a shame, because Apple makes some great pieces of hardware, but I won't be back until they loosen up on controlling the software that I'm able to run on my devices.
Reading it in translation, seems they identified the following as breaches:
1. When you visited bing.com they always dropped an ad fraud detection cookie.
2. After clicking around on bing.com, without clicking yes on any of the banners, it would drop an ads cookie.
3. On their cookie banner, rejecting took two clicks while accepting took one.
On 1, Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision).
On 2, Microsoft said it was an accident and had already stopped, though not before CNIL asking them about it
On 3, Microsoft argued that (a) rejecting was not actually required to be as easy as accepting and that (b) since the default was no cookies and it took a click to get cookies that rejecting was easier than accepting. The CNIL disagreed on both.
I've long suspected that these sites default to dropping cookies when my consent is neither asked for nor received, as MS appears to have done here.
It's good to hear that such behavior is probably illegal in the EU.