CNIL fines Google for €325M for sending spam emails

The Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority, has imposed a fine of €325 million on Google for sending unsolicited advertising emails to Gmail users.

In August 2022, the Austrian privacy organization noyb filed a complaint with the French data protection authority against Google for sending advertising emails to Gmail users. These messages appeared to be normal emails, but were actually ads to which users had never consented.

Commercial emails sent directly to users constitute direct marketing and are therefore regulated by the ePrivacy directive, meaning that companies are required to obtain permission to send these emails. Google neglected to do this.

Furthermore, Google was fined because it was more difficult to refuse tracking cookies than to accept them when creating a Google account. Users were also not adequately informed about the tracking during account registration, which, according to the regulator, meant that informed consent was not obtained.

In October 2023, Google added a button, making refusing and accepting tracking cookies equally easy. However, according to the French data protection authority, the problem with informed consent persisted.

Google has now been fined for both violations. The tech company has to pay a €325 million fine. On top of that, Google received an injunction to implement measures so that advertisements are no longer placed between Gmail users’ emails without prior consent.

Lastly, Google must obtain consent from users for the placement of tracking cookies. If the company fails to comply, it will be required to pay a penalty of €100,000 per day.

Max Schrems, Founder and Chairman of noyb, is happy with the CNIL’s decision to sanction Google. “Google tried to sneak commercial emails into the inboxes of Gmail users. This is only allowed if you obtain consent, a fact the CNIL has now confirmed,” he said in response to the supervisor’s ruling.