What Changed
- On September 23, 2026, CNIL's Restricted Committee closed the September 1, 2025 compliance injunction against Google LLC and Google Ireland Limited.
- Google updated its user registration flow to explicitly state that account creation requires advertising cookies in exchange for free services, and redesigned Gmail ads to separate them clearly from private emails.
- The CNIL affirmed that the closure applies strictly to the 2025 injunction scope and does not prevent future scrutiny of Google's full account creation workflow under French data protection law.
On September 23, 2026, the Restricted Committee of France's data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés), decided to close the compliance injunction previously issued on September 1, 2025 against Google LLC and Google Ireland Limited.
**Background and Injunction Scope**
In its September 1, 2025 decision, alongside a total fine of €325 million, the CNIL Restricted Committee ordered Google to bring its practices into compliance on two issues within six months, backed by a daily penalty payment of €100,000 per day of delay:
1. Provide sufficient information so that users located in France understand that creating a Google account necessarily involves the placement of advertising cookies.
2. Obtain prior consent from Gmail users before displaying advertisements designed as emails inserted between private messages.
**Compliance Actions Taken by Google**
Based on the response provided by Google LLC and Google Ireland Limited, the Restricted Committee determined that the companies satisfied the demands within the specified timeframe:
- **Account Creation Transparency:** Google updated the Google account creation process by adding explicit details clarifying that creating an account is conditioned on the placement of advertising cookies in exchange for receiving the service free of charge.
- **Gmail Advertisement Formatting:** Google altered the layout of advertisements shown in Gmail so that they are now clearly distinguishable from genuine private emails. Under this updated format, obtaining consent is no longer required pursuant to Article L. 34-5 of the French Postal and Electronic Communications Code (code des postes et des communications électroniques).
**Limitations and Future Regulatory Oversight**
The CNIL highlighted that this closure strictly concerns the scope of the injunction pronounced in its September 1, 2025 deliberation. The closure does not prejudge any future assessment by the CNIL regarding the full compliance of Google's entire account creation process with Article 82 of the French Data Protection Act (loi Informatique et Libertés), particularly concerning information clarity and screen intelligibility. Consequently, the CNIL reserves the right to carry out further audits and deploy its enforcement powers if necessary.
Who May Be Affected
Google LLC, Google Ireland Limited, digital marketing providers, online platform operators, and internet users in France.
Cross-Border Context
Relevant to multinational technology companies operating within the European Union digital single market subject to Member State data protection enforcement.
What to check next
- Review CNIL Deliberation SAN-2026-014 of September 23, 2026 on Légifrance.
- Review CNIL Deliberation SAN-2025-004 of September 1, 2025 on Légifrance.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.