On 23 September 2026 the CNIL's restricted committee, in deliberation SAN-2026-014, closed the injunction it had issued against Google LLC and Google Ireland Limited. The CNIL published the closure on 14 October 2026. The injunction dates from 1 September 2025, when the same body fined the two companies a combined €325 million: €200 million for Google LLC and €125 million for Google Ireland. The closure is narrower than it looks, and it says more about how European privacy law handles advertising than about Google.
What the CNIL actually decided
The 2025 decision (SAN-2025-004) found two breaches. Ads styled as emails in Gmail's Promotions and Social tabs were shown without consent, contrary to Article L. 34-5 of the postal and electronic communications code. Consent to advertising cookies at account creation was neither free nor informed, contrary to Article 82 of the French Data Protection Act. Google had six months to fix both, with a penalty of €100,000 per day of delay, per the CNIL's press release.
According to the CNIL's closure notice, Google met the deadline in two ways. At account creation it added information stating that advertising cookies are the condition of getting the free service. In Gmail it changed how ads are presented so they are clearly distinguishable from genuine emails. On that basis, the committee said, prior consent under Article L. 34-5 is no longer required for those ads.
The committee also reserved judgment. The closure covers only the scope of the 2025 order. It does not settle whether the whole account-creation process complies with Article 82, including the clarity of the information and whether the successive screens are understandable. The CNIL said it may run further checks and use its enforcement powers.
The case for the regulator's original position
The strongest argument for the 2025 decision is that inbox space is different from a web page. Users treat an inbox as a private channel. An ad that sits in the same list as personal messages, distinguished only by small visual cues, trades on that trust. PPC Land's account of the decision reports that the CNIL found Google's April 2023 label changes, such as black labels and advertiser logos, insufficient at the time. It also reports that accepting personalised-ad cookies took two clicks while refusing took six, and that the CNIL found this imbalance until October 2023. noyb, whose 2022 complaint started the case, argued that any advertising in a user's inbox falls under the ePrivacy consent rule. Those are serious points, and the fine reflected them: the CNIL said more than 74 million accounts were affected by the cookie breach and that 53 million people saw the ads in question.
Why the closure is the better outcome
The closure shows the remedy the law was supposed to produce. The CNIL did not require Google to stop selling advertising or to put a consent wall in front of a free product. It required honest disclosure and a clear visual line between ads and mail. Google supplied both, and the regulator accepted that consent was no longer needed for Gmail ads once they stopped being confusable with email. That is proportionate regulation: the harm was deception, and the fix removed the deception.
That approach is good for the open internet. Free, ad-supported services are how much of the world gets email, search and maps. Consent mechanics that fix a transparency problem by piling on prompts tend to produce click-through fatigue, not better-informed users. A rule that asks a company to say plainly what the trade is, and to label ads as ads, protects users and keeps the model viable. A regulator that closes a case when the specific defect is cured also gives other companies a reason to fix problems rather than litigate them for years.
The case also took a long time. noyb's complaint was filed in 2022, the fine came in September 2025, and the closure in September 2026. Because the CNIL acted under ePrivacy rules rather than the GDPR, it could decide on its own, which probably explains the speed relative to cross-border GDPR cases. Companies and users both benefit when enforcement cycles are shorter and the standard being applied is stated clearly.
What the reservation means
The open point is the real news for product teams. The CNIL accepted that the new information on advertising cookies satisfied the injunction as written, but it did not say the sign-up flow is lawful under Article 82. It specifically flagged the clarity of the information and the succession of screens. In practice, this means design details are still under review: wording, placement, and the number of steps between a user and an informed choice.
That creates uncertainty. A closure that comes with an open reservation gives a company no safe harbour, since the regulator can reopen the question with its full powers. The CNIL should say publicly what a compliant sequence looks like, as it has done with cookie-banner guidance, so that companies can build to a standard and not guess at one. Vague reservations tend to push firms toward the most defensive design, which is usually the most intrusive for users.
What to watch
- Whether the CNIL opens a new inspection of the account-creation flow, and whether it publishes criteria for judging the "successive screens".
- Whether other European authorities treat the disclose-and-label remedy as a template for inbox advertising.
- Whether the CNIL's reasoning that clearly distinguishable ads fall outside Article L. 34-5 consent is tested in later cases.
The closure is a sensible end to the injunction. The reservation is where the next dispute, if there is one, will be fought.