More than three years ago, noyb had filed a complaint against Google for sending unsolicited advertising emails directly to the inboxes of Gmail users. Contrary to EU law, the company never asked the people concerned for their consent. That's how the competent data protection authority sees it, too: Today, the CNIL has issued a decision siding with noyb – and fined Google €325 million.
Ads disguised as emails. Google sends Gmail users unsolicited advertising directly to their email inbox. On first glance, these messages look like normal emails, but are in fact ads to which users never consented to. Commercial emails sent directly to users constitute direct marketing and are regulated under the ePrivacy directive. This means that companies are required to obtain consent. This has also been confirmed by the Court of Justice, which said that any advertising in a user’s inbox is subject to the rule of consent.
Max Schrems, Chairman of noyb: “We are very happy about the CNIL's decision to sanction Google for this blatant breach of the GDPR. Google tried to sneak commercial emails into the inboxes of Gmail users. This is only allowed if you obtain consent – a fact, the CNIL has now confirmed.”
CNIL sides with noyb. The French data protection authority CNIL has now sided with noyb and found that Google’s implementation of spam advertising in Gmail violates its consent obligations under EU law. In addition, the authority said until October 2023, Google made it too difficult for users to refuse cookie consent when setting up their Gmail account. The CNIL has therefore imposed a fine of €325 million against Google.
Not the first CNIL fine against Google. Before this decision, The CNIL had already fined Google €150 million in December 2021 over their cookie violations and imposed a fine of €50 million Euro based on a noyb and a La Quadrature Du Net complaint because of Google’s opaque and unclear privacy notice and lack of legal basis for personalised ads.
What happens next. In addition to the €325 million fine, the CNIL has ordered Google to implement "measures to cease displaying advertisements between emails in the Gmail service users' mailboxes without prior consent and to ensure valid consent from users for the placement of advertising cookies when creating a Google account" within six months. If the company fails to comply, it will have to pay a penalty of €100.000 per day of delay.
