The National Commission on Informatics and Liberty (CNIL) has published a decision closing the injunction issued against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED, considering that they have complied with the specific requirements of its previous deliberation, notably by modifying the presentation of its advertisements in its messaging service and by clarifying the information on trackers during account creation.

Facts and context

The National Commission on Informatics and Liberty (CNIL) today published a decision closing the injunction that had been issued against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED, in addition to a fine of €325,000,000.

This injunction, accompanied by a penalty of €100,000 per day of delay, followed a sanction decision dated 1 September 2025 and required the company to correct two breaches within six months.

Reasons for the decision

The authority examined the measures taken by the companies to address the two points of the injunction and concluded that they had complied:

• Information on trackers during account creation: The authority had required that users located in France be sufficiently informed that creating a Google account necessarily involves the placement of trackers for advertising purposes. The authority found that the companies supplemented the account creation process by adding information specifying that this creation is conditioned on the placement of these trackers, in return for the free service. It considered that this measure met the injunction's requirement.
• Consent collection for advertisements in messaging: The injunction required obtaining users' consent before displaying advertising messages in the form of emails. To comply, the companies modified the format of these ads so that they are now clearly distinguishable from private emails. The authority considered that, under these conditions, consent collection was no longer required under Article L. 34-5 of the Postal and Electronic Communications Code, thus satisfying the injunction.

Authority's decision

Consequently, the authority pronounced the closure of the injunction procedure against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED, considering that the obligations set out in the deliberation of 1 September 2025 were fulfilled within the allotted time.

Lessons learned

This decision specifies that:

• A decision to close an injunction does not validate the overall compliance of a processing; its scope is strictly limited to the specific points targeted by the initial injunction, and the authority reserves the right to conduct further controls.
• To comply with an injunction, it is possible to modify the nature or presentation of a service to exclude it from the scope of the relevant legal obligation, as an alternative to implementing a compliance mechanism (such as consent collection).
• The information provided to the user must clearly indicate that access to a free service is conditioned on the placement of advertising trackers, presented as a counterpart to the service.