France’s data protection authority, the CNIL, has fined Google €325 million for inserting advertising emails into Gmail inboxes without user consent and for requiring cookies during account creation without valid authorization. The decision, announced September 1, follows a complaint by privacy group None Of Your Business (NOYB) in August 2022 and years of investigation.
The CNIL’s restricted committee found that Google Ireland Limited and Google LLC breached two French laws: Article L.34-5 of the Postal and Electronic Communications Code, which requires consent for direct marketing by email, and Article 82 of the Data Protection Act, which governs the use of cookies. The fine includes €200 million against Google LLC and €125 million against Google Ireland.
Investigators determined that Gmail users who enabled the “smart features” inbox setting were shown ads disguised as emails in the “Promotions” and “Social” tabs, affecting at least 53 million accounts in France. The CNIL cited a 2021 ruling by the Court of Justice of the EU that such messages constitute direct marketing requiring prior consent.
Separately, the regulator found that Google’s account creation process pressured users into accepting personalized advertising cookies, while failing to inform them that cookie placement was a condition of service access. Even after adding a refusal button in October 2023, the CNIL concluded that users still lacked sufficient information to provide informed consent.
The ruling orders Google to halt the Gmail advertising practice and to fix its cookie consent process within six months. If it fails, the company will face daily penalties of €100,000.
The CNIL emphasized that the breaches were serious given Google’s dominance in the online advertising market and Gmail’s global reach. It also noted Google’s history of prior cookie-related sanctions in 2020 and 2021, describing the company’s behavior as negligent.
With more than 74 million accounts impacted, the decision underscores regulators’ growing scrutiny of how tech giants blend advertising into core services and obtain user consent for data collection. Google has the option to appeal.
Need Help?
If you have questions or concerns about any global guidelines, regulations and laws, don’t hesitate to reach out to BABL AI. Their Audit Experts can offer valuable insight, and ensure you’re informed and compliant.
