CNIL fines Google €325M over hidden ads & cookie consent violations

The importance of complying with cookie consent requirements under the GDPR and ePrivacy Directive was also emphasized upon by other national authorities. On September 1st 2025, France’s data protection authority (CNIL) fined Google 325 million euros for two main violations: inserting adverts between Gmail users’ emails without consent, and placing advertising cookies during account creation without valid user consent. The whole sum was split between Google LLC (€200 million) and Google Ireland Ltd. (€125 million). Furthermore, the CNIL issued a remedial order, as in requiring Google to stop inserting ads into users’ inboxes without consent and applying valid consent mechanisms. Google has to adhere to the order within six months, whereas every day beyond that deadline will amount to additional fines, as in €100,000 per day.

The violations of concern entailed unauthorized ads inside inboxes, which were judged to be direct marketing by email without users’ prior consent. Further, during account registration, users were not provided with clear and equal options to reject advertising cookies, which deemed given consent to such as invalid under French law.

These developments suggest for companies targeting EU users to audit their cookie banners, tracking scripts and consent flows. As mentioned above, DP Dock is happy to support and advise in cookie banner compliance and consent requirements. All contact details can be found below.

For further information click here.