CNIL announced on 14 October 2026 that it had closed the injunction against Google LLC and Google Ireland Limited. Its decision, dated 23 September 2026, accepted changes to Google account creation and Gmail advertising within the scope of the order. The closure announcement expressly leaves wider account-creation compliance open to further scrutiny.
The €325 million fine belongs to the original decision of 1 September 2025. This follow-up concerns compliance with the accompanying injunction, rather than a new penalty or a cancellation of that fine.
What the 2025 order required
The original sanctions addressed advertising cookies during account creation and advertisements resembling emails within Gmail. CNIL found that French users had not given valid consent for the cookie placement and that the inbox advertisements required prior consent under French electronic-marketing rules.
The order required clearer information that creating a Google account necessarily involved advertising cookies, alongside compliance concerning the Gmail advertisements. Google had six months following notification to comply, backed by a daily penalty for delay. The fine and the compliance order were separate elements of the enforcement action.
What Google changed
The closure decision records changes to both the web and mobile versions of Gmail. Advertisements were fixed at the bottom of the Promotions and Social tabs, used a different colour from emails and carried an advertising label. Users could scroll through emails without moving the advertisements, and could dismiss an advertisement for that session.
CNIL concluded that the changed format clearly distinguished these advertisements from genuine emails. In that configuration, the consent requirement at issue under Article L.34-5 of the French Postal and Electronic Communications Code no longer applied. This finding concerns the redesigned placement; it does not remove consent requirements for email marketing as a whole.
Google also added information explaining that access to its free services through account creation depended on advertising cookies. The decision describes changes to both account-creation routes, including more balanced descriptions of generic and personalised advertising. CNIL accepted that the companies had met the specific injunction within the prescribed period.
The closure leaves wider questions open
The decision’s operative part states that there was no basis to levy the daily penalty. That finding addresses the injunction’s penalty mechanism. It should not be read as a finding about payment or appeal status of the historical €325 million fine.
CNIL also identified continuing concerns. Paragraphs 10–13 address information scattered across screens, choices that remained unclear and cookie-purpose information appearing after the user had already expressed a choice. The panel reserved its position on compliance of the account-creation process as a whole with Article 82 of the French Data Protection Act.
What this means for marketing and compliance teams
This is a French enforcement outcome under the national rules implementing ePrivacy requirements. It is not a general approval of Google’s services or a ruling on UK marketing law. For further reading on the separate UK context, see our consent-or-pay explainer; the official decisions remain the authority for this French case.
Measured Collective’s editorial takeaway is to record exactly what a regulator has accepted when tracking remediation. Here, changes sufficient to satisfy a particular order coexisted with unresolved concerns about the wider user experience. Keep that boundary explicit in internal reporting of the closure.
