Google handed €325 million fine in France over Gmail ads and cookies

The French privacy watchdog (CNIL) handed Google a €325 million fine on Wednesday for inserting advertising between Gmail users’ emails and dropping tracking cookies without consent. 

The fine, announced late night on Wednesday, is the result of two breaches of French advertising and cookie laws, and follows a 2022 complaint by privacy group Noyb.

The first breach concerns Google’s practice of inserting advertising in-between Gmail users’ emails without their consent.

The CNIL’s investigation revealed that Google bundled ads in with optional “smart features” it offered Gmail users. Those who agreed to switch on the “smart features” had ads inserted into their reorganised Gmail inbox – in new “Promotions” and “Social” tabs – without their consent.

The CNIL found Google’s practice to be illegal under the French Postal and Electronic Communications Code, the national implementation of the EU’s ePrivacy Directive, which regulates private communications.

It also concluded that Google had failed to obtain valid consent for deploying advertising cookies. Google users are encouraged to accept cookies for personalised ads, instead of receiving more generic advertisements, according to CNIL’s press release.

“Users were not clearly informed that the deposit of cookies for advertising purposes was a condition to be able to access Google’s services,” it said.

The fine is among the highest imposed by the privacy watchdog. But the CNIL justifies this by the sheer amount of users affected – 53 million Gmail users get the advertising emails and 74 million accounts are concerned by the cookie consent breach.

“We are very happy about the CNIL’s decision to sanction Google for this blatant breach,” privacy activist and chairman of Noyb, Max Schrems, said in the organisation’s press release.

Responding to the sanction, a Google Spokesperson told Euractiv that the company is reviewing the decision. They also said it has been working with the CNIL to address concerns about how ads are displayed in its products.

“Over the last two years, as the CNIL has acknowledged, we made additional updates to address their concerns, including an easy way to decline personalised ads in one click when creating a Google account, and changes to the way ads are presented in Gmail,” the spokesperson said.

On Wednesday, France’s CNIL also handed Chinese ecommerce giant Shein a €150 million fine for failing to obtain user consent before placing ad cookies on user devices when they visited its website.

Users were not given sufficient information in cookie banners, and their rights to refuse or withdraw consent were not fully respected, it found.

(nl)