FR SA: Cookies and advertisements inserted between emails: GOOGLE fined 325 000 000 EUR by the CNIL

by

Background information

  • Date of decision: September 1st, 2025
  • National case
  • Controller: GOOGLE IRELAND LIMITED and GOOGLE LLC
  • Legal Reference: Obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code); Use of cookies without free and informed consent (Article 82 of the French Data Protection Act)
  • Decision: Infringement of the French Post and Electronic Communications Code, Infringement of the French Data Protection Act, Administrative fine and injunction
  • Key words: Commercial prospecting, cookies

 

Summary of the Decision

Origin of the case

Following a complaint filed by the organisation None Of Your Business (NOYB) on 24th August 2022, the French Supervisory Authority (CNIL) conducted several inspections in 2022 and 2023 on the Gmail messaging service and on the process of creating a Google account.

Key Findings

The investigations revealed that GOOGLE IRELAND LIMITED and GOOGLE LLC displayed advertisements in the form of emails among the emails in the “Promotions” and “Social” tabs of the Gmail messaging service. The CNIL considered that the display of such advertisements required the consent of Gmail users, in accordance with Article L. 34-5 of the French Postal and Electronic Communications Code (CPCE).

Furthermore, the CNIL considered that, when creating a Google account, users were encouraged to choose cookies linked to the display of personalised advertisements, to the detriment of those linked to the display of generic advertisements and that users were not clearly informed that the use of cookies for advertising purposes was a condition to be able to access Google’s services. Their consent obtained in this context was therefore not valid, which constituted a breach of the French Data Protection Act (Article 82).

Decision

For these two breaches, the restricted committee issued a public decision imposing:

  • Two fines totalling 325 000 000 EUR against GOOGLE (200 000 000 EUR against GOOGLE LLC and 125 000 000 EUR against GOOGLE IRELAND LIMITED);
  • An order requiring the companies to implement, within six months, measures to cease displaying advertisements between emails in the Gmail service users’ mailboxes without prior consent and to ensure valid consent from users for the placement of advertising cookies when creating a Google account. Failing this, the companies will each have to pay a penalty fee of 100 000 EUR per day of delay.

For further information: Decision: