Andy Garcia · freelance dev
FRENES
Back to the blog
Privacy & UX

Google Met a French Order Backed by 100,000 Euros a Day. The CNIL Still Faults Its Signup Screens

October 19, 2026 8 min read

On October 14, 2026, France's data protection authority, the CNIL, published a decision its restricted committee had taken on September 23: the injunction attached to the 325 million euro fine it imposed on Google LLC and Google Ireland on September 1, 2025 is closed. That order gave Google six months to fix two things, under a penalty of 100,000 euros per day of delay. The decision says there is no ground to collect any of it.

The CNIL's announcement fits in a few lines. Google changed its Gmail ads so that they are "clearly distinguishable from the actual emails", which means consent "is no longer necessary" under the French rule on email marketing. And Google's account creation now says that creating an account requires advertising cookies, "in return for the service being free of charge."

The deliberation itself, SAN-2026-014 on Légifrance, is more useful. It describes, almost pixel by pixel, the design the regulator accepted, then spends its last four paragraphs on what still falls short.

I care about this for practical reasons. I ship iOS apps and a strategy game, Doomsday: M.A.D., as an indie developer, I built BidForge for French small businesses, and I am CTO of a LegalTech. This case answers two questions that come up whenever a product reaches French users: how a signup screen should explain what people agree to, and how a free product may show ads. A regulator rarely tells you what passed. This one did.

What Google was ordered to fix

The case started with a complaint from the privacy group NOYB on August 24, 2022. The CNIL ran inspections in 2022 and 2023 and found two problems.

First, Gmail users who enabled the smart features that sort the inbox into tabs saw ads shaped like emails, inserted between their real messages in the Promotions and Social tabs. Relying on a ruling of the EU Court of Justice from November 25, 2021, the CNIL treated a promotional message shown in a space reserved for private email, and looking like a real email, as direct marketing by email. That needs prior consent under Article L. 34-5 of the French postal and electronic communications code. Google had already changed the look of these ads in April 2023. In 2025, the CNIL said that was not enough: the ads still did not stand out clearly from real emails.

Second, account creation. The CNIL accepted that access to a service can be conditioned on advertising cookies, provided users fully understand the value, scope and consequences of their choice. Google's flow never said that creating an account meant accepting ad cookies, so consent was not informed.

The CNIL tied the amount to the scale: more than 74 million accounts in France concerned by the cookie breach, 53 million of which had seen the ads. Google LLC was fined 200 million euros, Google Ireland 125 million.

The ad that no longer needs email-marketing consent

Here is what the deliberation describes on the web and mobile versions of Gmail:

  • The ads are now pinned at the bottom of the Promotions and Social tabs, and they stay fixed: you can scroll your emails without the ads moving.
  • They are not the same color as emails.
  • The word "Annonce" (ad) sits where the sender's name appears for an email.
  • You can delete them, with an icon on the web or a swipe on mobile. Once you do, no other ad appears for the rest of the session. New ones come back only when you log in again.

Two things in that list matter to anyone who builds a feed. The first is that a label alone did not do it. Google's 2023 changes were visual too, and they failed. What passed is a combination of position, behavior, color, the label placed in the slot that normally identifies the sender, and a dismissal that sticks.

The second is the scope. The CNIL's sentence is about Article L. 34-5, the rule on marketing by email. It says nothing about the cookies used to choose those ads, which fall under a different article. My reading is that a distinguishable ad escapes the email-marketing consent, not every consent.

The sentence that made the cookie wall informed

On account creation, Google added a sentence at the step the CNIL calls "the fork", where the user picks one of the two signup paths. In my translation: "Ads allow us to offer most of our services for free. To create a Google Account, you must accept the use of cookies and similar technologies, including for advertising purposes."

It also added explanations of the choices. Refuse personalized ads and you still see ads, generic ones based on contextual factors, and cookies are used to show and measure both kinds. And one step of the longer path was renamed more neutrally: it used to say "Turn on ad personalization to see more relevant ads", and now says "To control ads, select your ad experience" (again my translation).

The injunction asked for better information, and the CNIL found that Google provided it on time. Nothing in the decision required a cookie-free or paid alternative. That is the practical lesson for a French product with a free tier: ad cookies can be the price of the service, as the 2025 decision already allowed, and here a plain sentence at the fork, plus explanations of the options, was enough to close the order. It did not clear the rest of the flow, as the next section shows.

What the CNIL still faults

Then comes the part the press release only hints at. The committee writes that closing the injunction does not mean the whole signup flow complies, and lists what bothers it:

  • The "1-step" path, the one meant to be fastest, now has four screens. The version shown during the proceedings had two. More screens on the quick path make it more complex and less intelligible.
  • The information is scattered across the flow, among information about other processing, and some choices still lack clarity. The example given is "Reject all", which covers three settings at once: web activity, YouTube history and personalized ads.
  • In the 1-step path, a user still cannot actively choose generic ads, by ticking a box for example. Generic ads are only reachable by refusing personalized ones.
  • The "Accept cookies" step, which carries a large amount of information about cookie purposes, appears late in both paths, after the user has already made a choice about cookies.

The CNIL says it reserves the right to carry out further investigations and, "if necessary, to mobilise its entire enforcement chain."

It has used that sentence before. In May 2021, Next reported that the CNIL had closed the injunction attached to the 100 million euro fine it gave Google in December 2020, with the same reservation. Closed is not cleared. And the closure covers the order, not the fine: on January 9, 2026, MLex reported that Google was seeking to overturn the 325 million euros.

The timeline is a lesson too

The deliberation lists the exchanges. The 2025 decision was served on the two companies on September 2 and 3, 2025. Google sent material on December 11, 2025, then wrote to the CNIL on January 13 and 26, 2026, presenting the changes it planned. CNIL staff answered on February 25. Google sent its evidence on April 15. The committee deliberated on September 17 and decided on September 23.

Google showed the regulator its design before shipping it. A small company rarely gets that back-and-forth. It does get the result, published and free to read: the closest thing to an accepted spec this area has.

What I would check before shipping a signup or an in-feed ad in France

  1. If anything promotional appears where users read their own messages, make it unmistakable by position, behavior, color and a label where the sender would be, and make dismissal stick. Otherwise, ask for consent. The CNIL's reasoning was about an inbox, but I would apply the same test to any list that looks like messages.
  2. If the free tier is paid for by ad cookies, say so in one sentence at the first fork, before any choice.
  3. Give the less intrusive option its own button or box. Do not make it reachable only by refusing the other one.
  4. Do not bundle unrelated settings under one "Reject all" without saying, on that screen, what it covers.
  5. Show the cookie purposes before the choice, not after it.
  6. Count the screens. If you call a path fast, the CNIL may count them too.
  7. Keep dated screenshots of every version of the flow. This decision compares the flow shown during the proceedings with the one shipped afterwards, and you will want the same record.

Google was fined 325 million euros over an inbox and a signup flow. The two decisions that say what passed, and what still does not, cost nothing to read.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk