France’s data protection authority has fined Google €325 million ($381 million) for breaching European Union privacy rules by displaying ads in Gmail and placing tracking cookies without proper consent.
The Commission Nationale de l’Informatique et des Libertés (CNIL) said its investigations between 2022 and 2023 found that advertisements were inserted into Gmail’s “Promotions” and “Social” tabs without users’ approval. The regulator also said Google encouraged users to accept cookies without making clear that the data would be used for targeted ads.
“These advertisements required prior consent from users, which was not obtained,” CNIL said. The regulator added that Google must change its practices or face additional penalties of up to €100,000 per day.
Google told Reuters it was reviewing the ruling. “We have always provided users with controls over the ads they see,” a company spokesperson said.
The fine adds to Google’s history of disputes with French authorities. It was fined €50 million in 2019 for GDPR violations, sanctioned again in 2020 and 2021 over cookies, and ordered to pay $590 million in 2021 in a separate competition case.