Google fined €325 million by CNIL for ads in Gmail and cookie-consent failings

France’s data regulator, CNIL, announced a €325 million fine on Google after finding that ads were being inserted between users’ Gmail messages without valid consent, and that advertising cookies were installed during account registration without giving users a choice and obtaining their informed consent. 

‍

The investigation, which stemmed from a complaint filed by the organisation None Of Your Business, found that users often received ads in their inboxes that appeared to be emails, and that cookie policies were not clearly explained to users when creating a new account. CNIL considered this a breach of consent and transparency obligations under the GDPR and gave Google six months to correct practices or face additional daily fines. This sanction is one of CNIL’s largest and highlights the regulator’s focus on user-interface design and hidden tracking.

‍