On September 1, 2025, France’s data protection authority, CNIL, imposed fines totaling €325 million on Google LLC and Google Ireland Limited. This penalty arose from serious violations involving the display of advertisements in Gmail between users’ emails without their explicit consent, impacting over 53 million users. Furthermore, the investigation revealed shortcomings in Google’s cookie consent mechanisms during account creation, where users faced an imbalanced choice favoring acceptance of personalized advertising cookies.
The enforcement action was initiated by a complaint from privacy organization None Of Your Business (NOYB) in August 2022. CNIL’s investigation found that advertisements were disguised as genuine emails within Gmail’s “Promotions” and “Social” tabs, violating rules set by the Court of Justice of the European Union. The authority emphasized that consent for direct marketing through email must be clearly obtained from users.
Besides the email advertising issues, the cookie consent mechanism also raised legal concerns. Users faced difficulty rejecting personalized advertising cookies, with a cumbersome process that made consent gathering inequitable. The consent options were skewed heavily toward acceptance, violating the legal requirement for equal accessibility in data processing consent.
The ruling marks one of CNIL’s largest financial penalties against a major tech company, reflecting its increasingly stringent enforcement of data privacy regulations. The scale of violations, which involved more than 74 million accounts concerning cookie issues, underscores the gravity of the situation for users in France. Google, despite implementing some visual changes to clarify the difference between ads and real emails, was found to inadequately address user confusion, prompting CNIL to maintain its stance on the necessity of valid consent.
In summary, this case illustrates a growing trend toward enforcing privacy regulations and holding major tech companies accountable. As marketers, we need to recognize the significance of transparent user consent and prioritize ethical data practices. Upholding user privacy isn’t just a legal responsibility—it fosters trust and loyalty in an increasingly wary digital landscape. Balancing innovative marketing strategies with compliance will be crucial for sustainable success.
