Summary
- CNIL closed the September 2025 injunction by decision on 23 September 2026.
- Google changed account-creation disclosures and the presentation of advertising in Gmail.
- The regulator has not declared Google’s entire account journey compliant.
France’s data protection authority, the CNIL, has closed an injunction against Google after changes to information shown during account creation and the presentation of advertising in Gmail. The authority published the decision on 14 October 2026, although its restricted panel made the decision on 23 September. The closure resolves specified orders imposed alongside a €325 million penalty in September 2025; it is not a declaration that every element of Google’s data processing complies with French law.
The 2025 action concerned two different practices. The regulator required Google LLC and Google Ireland Limited to give people in France sufficient information that creating a Google account necessarily involved the placement of advertising cookies. It also directed the companies to obtain consent before displaying advertisements formatted as messages among private emails in Gmail. Failure to meet the injunction could have triggered a €100,000 daily penalty.
Google subsequently amended the account-creation journey to explain the advertising-cookie condition and changed Gmail’s advertising format so promotional material was clearly distinguishable from actual messages. CNIL concluded that the new presentation no longer required the particular consent specified by the original order under the applicable French communications code. The decision therefore turns on the precise requirements of that injunction and the changes Google made in response.
The closure leaves separate questions of consent and transparency unresolved. A notice that explains why a service places cookies does not automatically settle whether every processing activity, interface choice or subsequent use of data meets all applicable privacy requirements. Likewise, a clearly separated advertising unit may not be subject to the same rule as an advertisement that resembles an email, but other data protection duties can still apply.
CNIL expressly retained the option of examining the Google account-creation process under Article 82 of the French Data Protection Act. It singled out the clarity of information and the intelligibility of successive screens as matters that may warrant further investigation. Businesses operating consent flows across several services face similar challenges: regulatory decisions often apply to a defined practice, population and remedy rather than an entire product or brand.
The September 2025 fine and its accompanying remedial requirements were distinct regulatory measures. A completed remedial order provides evidence that a company has addressed the conduct specified in an enforcement notice. It does not demonstrate that all design alternatives have been assessed, nor does it cancel the earlier fine. For large digital platforms, changes to account registration and advertising presentation may touch systems used in multiple markets, while national regulators assess their particular legal framework.
The visible change for people in France is a clearer explanation of advertising cookies at registration and advertisements in Gmail that no longer look like ordinary correspondence. The regulator’s public account does not claim that its action concerns a breach, hacking incident or exposure of email contents. It describes a dispute about lawful information, consent and the design of digital services.
CNIL's treatment of Gmail advertising also illustrates how the legal character of an interface can change when its presentation changes. The authority did not say that Google had stopped displaying advertising in the service. Rather, it accepted that the new advertisements were visibly differentiated from emails, altering the application of the specific consent provision cited in the order. A claim that Gmail advertising ended, or that advertising-cookie consent was now universally unnecessary, would misrepresent that distinction. The underlying account-creation issue was assessed separately, on the adequacy of information provided during registration. Both remedies address how information and options are presented to users, with the regulator judging compliance against the particular terms of its September 2025 injunction.
The September 2025 sanction and September 2026 closure therefore belong to the same regulatory sequence, with CNIL’s 14 October announcement documenting completion of specified requirements. The authority says it remains able to investigate the wider account journey if the evidence warrants it.
