France’s data protection authority, CNIL, has fined Google €325 million (approximately $381 million) for violating privacy rules by showing ads inside Gmail without proper user consent. The ruling, announced on September 3, 2025, highlights ongoing regulatory scrutiny of Big Tech’s handling of user data.
CNIL rules Google displayed Gmail ads without valid user consent
Investigators found that Google displayed ads between Gmail messages and relied on cookies and other tracking methods without obtaining legally valid consent from users. CNIL also criticised the company’s account creation process, stating that it did not provide clear or valid consent options for personalised ads. Google has been ordered to make compliance changes within six months or face additional fines of €100,000 per day (Reuters).
In its ruling, CNIL emphasised that consent must be freely given, specific, and informed. It argued that the way Google structured its ad delivery and account setup did not meet these legal standards. Regulators said this practice undermined user choice and exposed individuals to advertising without adequate protections.
Google responded by saying it was reviewing the decision and reiterated that it already offers users tools to manage personalised ads, including the option to opt out. However, privacy advocates argue that the company’s systems make it too difficult for users to reject tracking, and this fine is a necessary step toward stronger enforcement.
For Google, the ruling adds to mounting regulatory challenges across Europe. Alongside recent antitrust fines, the company faces increasing pressure to align its advertising and data practices with EU law. The fine also highlights France’s active role in enforcing the General Data Protection Regulation (GDPR).
For advertisers, the case raises questions about the reliability of Google’s platforms if compliance changes alter how ads are displayed. Gmail has long been an important channel for reaching users, and stricter consent requirements may reshape how campaigns can be targeted there.
With daily penalties on the line, Google is expected to make significant changes to Gmail’s ad delivery and its broader consent mechanisms. How quickly it adapts will be closely watched by regulators, advertisers, and users alike.
