€325m fine handed to Google from French regulator for consent issues

The French data protection authority, CNIL, has fined Google €325 million for failing to obtain valid consent for Gmail advertising. The CNIL found that Google placed advertisements within Gmail's "Promotions" and "Social" tabs without users' prior consent, effectively inserting them between private messages between user emails. The CNIL also found that Google failed to obtain valid consent for placing advertising cookies during the account creation process. Google has been ordered to make changes within six months or face further penalties, including ceasing to display advertisements between emails in the Gmail user interface without valid, prior consent.

CNIL is one of Europe’s most active data protection authorities and has a record of strict enforcement in areas such as cookies, advertising, and transparency. The latest action reinforces its stance that advertising placements resembling organic content, such as emails, are direct marketing and must meet the same rules on consent.

The ruling also makes clear that design and presentation are as important as the substance of data use. Where advertising is delivered in formats that appear indistinguishable from personal content, the requirement for consent becomes stronger. Marketers should continue to review consent flows, cookie banners, and advertising formats in light of this development.

The DMA is closely engaged with these issues at a European level through its membership, the Federation of European Data and Marketing Associations. FEDMA brings together national data and marketing associations across Europe, including the DMA, to provide a collective voice for the industry in Brussels. It works with EU institutions to influence legislation, promote responsible marketing practices, and support innovation across Europe and is co-chaired by the UK DMA’s Chris Combemale..

The message to big data is clear - regulators across Europe and in the UK are still paying close attention to the way advertising is delivered and how consent is obtained.

As Europe continues to be foundational influence and necessarily linked to UK data protection legislation, the DMA will continue to represent the industry, monitor developments across Europe and support members in maintaining compliance while enabling data-driven innovation.