Google in France: three CNIL cookie fines, from arrival cookies to a lopsided sign-up

Google has been sanctioned by CNIL three times for cookie consent, and each decision targets a different part of the flow: what is set before the banner, how hard Reject is, and whether people creating an account understand which cookies come with it. Read together, they are a checklist for any consent journey.

CNIL · French Data Protection Act, Article 82 · Decisions of 7 December 2020, 31 December 2021 and 1 September 2025

This page covers all three cookie decisions as separate records on one page, because CNIL treats them as a sequence: the 2025 decision counted the 2020 and 2021 sanctions as evidence of negligence (CNIL, 3 September 2025).

The problem

In 2020, opening google.fr from France set advertising cookies before any action, under a banner that only mentioned the privacy policy. In 2021, accepting cookies on google.fr and youtube.com took one click and refusing took five. Until October 2023, creating a Google account made personalised ads one step and generic ads a five-step route, and never said that some advertising cookies came with any account (CE No 449209 ¶¶ 16–18; SAN-2021-023 ¶ 133; SAN-2025-004 ¶¶ 117, 133). These are CNIL findings.

Case record

Case record
Fact	2020	2021	2025
Decision	SAN-2020-012, 7 December 2020	SAN-2021-023, 31 December 2021	SAN-2025-004, 1 September 2025
Surface	google.fr	google.fr, youtube.com	Google account sign-up; Gmail
Fines	EUR 60,000,000 (Google LLC) + EUR 40,000,000 (Google Ireland)	EUR 90,000,000 (Google LLC) + EUR 60,000,000 (Google Ireland)	EUR 200,000,000 (Google LLC) + EUR 125,000,000 (Google Ireland)
Injunction	Inform users; EUR 100,000 per day	Equal refuse option; EUR 100,000 per day	Inform at sign-up; Gmail ad consent; EUR 100,000 per day each
Status	Upheld by Conseil d'État, 28 January 2022	Injunction closed 13 July 2023	Injunction closed 23 September 2026

Sources: SAN-2020-012; CE No 449209; SAN-2021-023; 2023 closure; SAN-2025-004; 2026 closure. Source review: 17 October 2026.

The rule behind all three: storing or reading information on a device "is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information" (ePrivacy Directive Art. 5(3)). The 2025 fine also covered a separate breach of Article L. 34-5 of the French Postal and Electronic Communications Code: ads styled as emails in Gmail’s Promotions and Social tabs without consent. CNIL did not split the €325 million between the two breaches (SAN-2025-004, operative part).

The problem
Case record
What the regulator found
Technical issue
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What the regulator found

What the regulator found
Decision	Requirement	Finding
2020	Consent before non-exempt cookies; clear information; a working opt-out	Seven cookies set on arrival, four for advertising (`NID`, `IDE`, `ANID`, `1P_JAR`); banner said only "Rappel concernant les règles de confidentialité de Google"; after turning off ad personalisation, an advertising cookie was still read ([SAN-2020-012 ¶¶ 79–80, 98–108](https://web.archive.org/web/20220128195957/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706); [CE ¶ 16](https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2022-01-28/449209))
2021	Refusing as easy as accepting	"J'accepte" (I accept) was one click; refusing meant "Personnaliser" (Customise), three toggles and "Confirmer" ([SAN-2021-023 ¶¶ 120, 123, 133](https://web.archive.org/web/20220128200722/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840062))
2025	Free and informed consent at sign-up	Until October 2023, two clicks to accept personalised-ad cookies, six to choose generic ads. After October 2023 Reject all and Accept all buttons were added, but users were still not told that advertising cookies (personalised or generic) are a condition of having an account ([SAN-2025-004 ¶¶ 117–134](https://www.cnil.fr/sites/default/files/2025-09/cnil_sanction_google_en.pdf); [CNIL](https://www.cnil.fr/en/cookies-and-advertisements-inserted-between-emails-google-fined-325-million-euros-cnil))

Technical issue

Tools: Google’s own advertising and preference cookies on google.fr and youtube.com, and the account-creation flow reached from the google.fr "Sign in" button (SAN-2025-004 ¶ 117).
When, relative to consent: before any action (2020); after an asymmetric choice (2021); inside a sign-up flow where no option avoided ad cookies (2025, ¶ 125).
Scale: at least 47 million Google Search users in France in 2020 (CE ¶ 23); over 51 million Google and 46 million YouTube monthly visitors in 2021 (SAN-2021-023 ¶ 144); more than 74 million accounts affected by the 2025 cookie breach (CNIL).
How it came to light: CNIL online inspections (16 March 2020, 1 June 2021) after complaints; in 2025, a NOYB complaint and inspections in 2022 and 2023.

Inth’s technical interpretation: CNIL accepted in 2025 that a free service may require advertising cookies, a form of cookie wall, but only if people understand that before they agree, and only if the cheaper choice for privacy is not buried (SAN-2025-004 ¶¶ 127–131). For engineers, step count is the measurable proxy: if one path has more screens, toggles or confirmations than the other, CNIL treats the choice as steered.

Illustrative pattern, not the defendant’s code.

// Bad: privacy-protective route is longer and the condition is never stated
<SignupStep>
  <Button primary onClick={acceptPersonalisedAds}>Express setup (1 step)</Button>
  <Button onClick={openFiveStepWizard}>Manual setup (5 steps)</Button>
</SignupStep>

Illustrative pattern, not the defendant’s code.

// Fixed: the condition is stated and both choices take one click
<SignupStep>
  <p>An account uses advertising cookies. Choose how ads are chosen for you.</p>
  <Button onClick={() => chooseAds('personalised')}>Personalised ads</Button>
  <Button onClick={() => chooseAds('generic')}>Generic ads only</Button>
</SignupStep>

Outcome

2020: €100 million and an injunction to inform users of all cookie purposes and how to refuse. CNIL found it met on 30 April 2021 (SAN-2021-004). The Conseil d’État rejected Google’s appeal on 28 January 2022, upholding CNIL’s jurisdiction and the amount (CE No 449209; SAN-2021-023 ¶ 10).
2021: €150 million and an order to offer refusal as simple as acceptance. Google added "Tout refuser" (Reject all) next to the accept buttons; CNIL closed the injunction on 13 July 2023, saying the closure did not cover other Article 82 questions (CNIL closure).
2025: €325 million and orders to inform account creators that advertising cookies are necessarily set, and to get consent before Gmail inbox ads. On 23 September 2026 CNIL closed the injunction after Google added that information to sign-up and restyled Gmail ads so they are clearly distinct from emails. CNIL said the closure does not prejudge the rest of the sign-up flow (CNIL, 14 October 2026).

What it cost

What it cost
Item	Amount
2020 fines	EUR 100,000,000
2021 fines	EUR 150,000,000
2025 fines (cookies and Gmail ads together)	EUR 325,000,000
Total across the three decisions	EUR 575,000,000
Penalty payments	None found; each injunction was found met in time
Appeals of 2021 and 2025 decisions	Not stated in the cited record

Why it matters

The 2020 Conseil d’État ruling settled that CNIL can sanction cookie practices of companies established elsewhere in the EU, because ePrivacy sits outside the GDPR one-stop shop; CNIL relied on it against SHEIN in 2025. The 2021 decision made "refuse as easily as accept" an enforced rule, later applied to Microsoft Bing. The 2025 decision opens a narrow door for consent-or-pay style walls while fining their presentation. See unequal choices and GDPR and ePrivacy cookie rules.

How Inth catches this

Code audit: flags a pull request that adds an advertising tag or ad-cookie write to a sign-up or landing flow outside the consent check.
Website audit: records what loaded before a choice and after Reject, with page, time, region and consent state, so arrival-time ad requests are visible.
Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses, and the Google tag loads with Google Consent Mode v2 defaults set to denied. By default the banner gives Accept and Reject the same weight. Check your own sign-up screens separately; they are outside the banner.
Evidence: consent records show each visitor’s choice, country and policy.

None of this covers in-product choices such as ad-personalisation settings inside an account, or ads rendered in an inbox.

Checks for your own systems

In the repository

Find every screen that asks about cookies or ads, not only the banner: sign-up, onboarding, settings.
Count the steps on each path and record them in the design review.
Search for cookies set on first load and map each to a declared purpose.

In the browser and network

In a fresh EU-geo profile, capture cookies before any click on the home page and on the sign-up entry page.
Click Reject and confirm that ads, doubleclick and similar domains receive no requests.
Turn off ad personalisation in your own settings and check no ad cookie is still sent.

With the people responsible

If access depends on ad cookies, write down the condition in plain words and where users see it.
Keep dated screenshots of each consent screen.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Google’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.