The French Data Protection Authority (CNIL) has issued a significant fine of €325 million against Google (distributed between Google LLC and Google Ireland Limited) for displaying advertisements within the Gmail service without obtaining valid user consent. The ruling, announced on September 3, 2025, is a direct result of a complaint filed by the privacy advocacy group noyb (None of Your Business) in 2022.
The CNIL's investigation found that Google displayed advertisements disguised as emails within the "Promotions" and "Social" tabs of users' inboxes. The authority determined that this practice constitutes direct marketing and, under the French Postal and Electronic Communications Code (CPCE) which transposes the EU's ePrivacy Directive, requires the explicit prior consent of the user.
The investigation concluded that the consent obtained by Google was not valid. As a result, the CNIL has not only imposed the substantial financial penalty but has also ordered Google to cease this practice within six months and to implement a valid consent mechanism for any future advertising of this nature.
This case highlights the ongoing scrutiny of Big Tech's advertising models by European data protection authorities. The CNIL has a history of levying significant fines against Google for non-compliance with privacy laws, and this latest decision reinforces the legal requirement for clear and unambiguous user consent in the digital advertising space. It serves as a major victory for privacy advocates and sets a strong precedent for how unsolicited commercial communications are treated under EU law.