DECISION SUMMARY
What happened
The restricted committee (formation restreinte) of the CNIL adopted a decision on 1 September 2025 imposing a combined €325 million penalty on Google: €200 million on the US parent Google LLC and €125 million on Google Ireland Limited. The decision followed the CNIL's investigation into how Google displayed advertising inside the Gmail interface and how it obtained consent for advertising cookies during account creation. The CNIL is competent over these practices because they affect users established in France, and it has consistently applied French national law to cookie and electronic-marketing questions where Google is the operator.
Two distinct practices were sanctioned. The first was the display of advertising that took the visual form of an email, inserted between genuine messages in the “Promotions” and “Social” tabs of the Gmail inbox. The CNIL treated these inserts as direct marketing, which under French law requires the recipient's prior consent. The second was the placement of advertising cookies on a user's device at the moment they created a Google account, in circumstances where the consent obtained was not valid.
The legal basis (and why it is not a GDPR-article fine)
The advertising-between-emails practice was sanctioned under Article L.34-5 of the French Postal and Electronic Communications Code (the CPCE), the provision governing unsolicited direct marketing by electronic means. The cookie practice was sanctioned under Article 82 of the French Data Protection Act, which transposes the ePrivacy Directive's consent requirement for storing or reading information on a user's terminal equipment. Neither anchor is a substantive GDPR article such as Article 6 (lawful basis) or Article 5 (principles). This is the same legal footing the CNIL used for its earlier cookie penalties against Google (€150 million and €90 million in 2022), Microsoft (€60 million in 2022) and others: the ePrivacy and CPCE rules, enforced by the CNIL under its national powers, rather than the GDPR's one-stop-shop machinery. The fine is nonetheless routinely counted among the largest data-protection penalties in France and in the wider GDPR-era enforcement record.
Why the fine was this size
The CNIL pointed to the scale of the practices and Google's position in the advertising market. The email-advertising and cookie practices concerned more than 74 million accounts, with around 53 million individuals having been shown the in-inbox advertising. The financial benefit Google derived from advertising, and the number of people exposed to the practices, weighed towards a substantial penalty. Splitting the amount between Google LLC (€200 million) and Google Ireland (€125 million) reflects the roles the CNIL attributed to each entity in the processing. The €325 million total makes this one of the CNIL's largest penalties to date, behind only the €50 million 2019 Google transparency fine in the CNIL's own GDPR case-law when measured against a single company, and well above the 2022 cookie fines.
The injunction and what Google must change
Beyond the monetary penalty, the CNIL issued an injunction requiring Google to cease displaying advertising between Gmail messages unless it first obtains users' consent. Google was given six months from the decision to bring the practice into compliance. If it fails to do so within that window, the CNIL attached a penalty payment of €100,000 per day for each of the two companies, a mechanism designed to make continued non-compliance progressively expensive rather than a one-off cost of doing business.
What this decision tells advertisers
The Google €325 million fine confirms two things about French enforcement. First, the CNIL treats advertising placed inside an inbox, formatted to resemble a message, as electronic direct marketing that needs consent, not as a display-advertising placement outside the consent regime. Second, the CNIL continues to police cookie consent at the exact moment it is obtained, including at account creation, and will not accept a consent flow that nudges users into acceptance. For any business operating advertising or cookie-consent flows in France, the practical lesson is that the point of consent, its clarity, and the ease of refusal are where the CNIL looks first, and that penalties are scaled to the number of people affected.