Google recently resolved a CNIL injunction that threatened fines of €100,000 per day. The French regulator's decision on September 23, 2026, to lift the order provides insight into what regulators deem acceptable for consent mechanisms. Unlike most enforcement actions that end in fines or appeals, this case concluded because Google made specific, verifiable changes within six months.
If you're managing consent infrastructure, this case directly relates to your work. Here's how to implement consent flows that meet regulatory standards.
Why This Matters
The CNIL's original September 1, 2025, injunction highlighted two issues: Google didn't clearly inform French users that creating an account meant accepting advertising cookies, and Gmail's ad format resembled real email too closely. Both violations were based on Article L. 34-5 of the French postal and electronic communications code, which governs terminal equipment access and cookie consent.
The closure is significant because it clarifies what "sufficient information" and "clear distinction" mean in practice. Regulators issue principles and evaluate your execution during enforcement. This decision shows what passed.
What You Need Before Starting
Before adjusting your CMP configuration, gather these resources:
Documentation of Your Current Consent Flow
Capture screenshots of every screen a user sees from landing page through account creation or cookie acceptance. Note where information appears, what actions trigger cookie writes, and which cookies fire before consent.
Your Cookie Inventory
List every cookie by category (Essential vs. Non-Essential), purpose, duration (Session vs. Persistent), and party (first-party vs. third-party). If using a Tag Manager, export your container configuration to see what fires on page load versus after consent.
Legal Basis Mapping
For each cookie category, document your legal basis for processing. Essential Cookies don't require consent under CNIL Recommendation guidance. Everything else needs prior consent or another valid basis.
Access to Your CMP Admin Panel
Ensure you have permissions to edit Consent Notice text, adjust button configurations, and modify cookie categorization. If using TCF v2.3, confirm you can update vendor lists and purpose disclosures.
A Test Environment
Never edit production consent flows without testing. Set up a staging instance to validate changes before deployment.
Step-by-Step Implementation
1. Audit Information Disclosure Timing
Google's fix added explicit information during account creation: users now see that creating an account requires accepting advertising cookies for free service access.
Review your account creation or onboarding flow. When do you disclose cookie purposes? The disclosure must appear before the user commits to the action that triggers cookie writes.
If your Consent Notice appears after account creation starts, move it earlier. Users need to understand the trade-off before they click "Create Account."
2. Rewrite Purpose Disclosures for Granularity
"We use cookies to improve your experience" is insufficient. Google's approved language specifies that advertising cookies are required for account creation and that the service is free because of those cookies.
Revise your Purpose Disclosure text to include:
- Specific cookie categories ("advertising cookies" not "Non-Essential Cookies")
- Why they're necessary ("to fund free service" not "to enhance functionality")
- What happens if the user declines (can they still create an account? Access core features?)
3. Establish Visual Distinction for Ad Content
The second injunction point addressed Gmail ads that resembled real email. Google modified the ad format so users could clearly distinguish promotional content from personal messages. The CNIL accepted this change as eliminating the need for separate consent under Article L. 34-5.
If you display ads within content streams (email, feeds, search results), audit visual differentiation:
- Do ads use distinct background colors or borders?
- Is the label ("Ad," "Sponsored," "Promoted") immediately visible?
- Could a user mistake an ad for organic content?
Document your ad format in screenshots. If there's any ambiguity, redesign before a regulator makes you.
4. Separate Essential from Non-Essential Cookie Firing
Check your Tag Manager or CMP to confirm Essential Cookies fire on page load but Non-Essential Cookies wait for clear affirmative action. Google Tag Manager's default configuration often fires all tags immediately unless you've set consent-based triggers.
In GTM:
- Create a custom trigger: Trigger Type = "Consent Initialization"
- Set trigger condition: "Consent Status = Granted" for the relevant category
- Apply this trigger to all non-essential tags (analytics, advertising, social media)
Test in preview mode. Load your site, decline all Non-Essential Cookies, then check the network tab. You should see only Essential Cookies.
5. Implement Symmetry of Choice
The CNIL's broader guidance requires equal prominence between "Accept" and "Reject" options. If your Consent Notice shows a large green "Accept All" button and a tiny gray text link for rejection, you're broadcasting non-compliance.
Adjust your CMP configuration:
- Make "Reject All" and "Accept All" buttons the same size and visual weight
- Place them side by side or vertically aligned, not hidden in submenus
- Use neutral colors for both, or mirror the color scheme
This is symmetry of choice in practice.
Validation - How to Verify It Works
User Journey Testing
Have someone unfamiliar with your site complete these tasks:
- Create an account or trigger your Consent Notice
- Read the information provided and explain back what cookies will fire and why
- Decline Non-Essential Cookies and verify they can still access core functionality
If the tester can't clearly articulate the cookie trade-off, your disclosure isn't sufficient.
Technical Verification
Use browser developer tools:
- Open DevTools > Application > Cookies
- Clear all cookies
- Load your site and immediately check what fires before interaction
- Decline Non-Essential Cookies in your Consent Notice
- Refresh and verify only Essential Cookies appear
Repeat this test in Chrome, Firefox, and Safari. Cookie behavior varies by browser, especially with Partitioned Cookies and SameSite Attribute handling.
Regulatory Alignment Check
Compare your implementation against CNIL Recommendation guidance and EDPB Guidelines 05/2020 on consent. Specifically verify:
- Information appears before terminal equipment access
- Consent is freely given (no cookie wall blocking access)
- Users can withdraw consent as easily as they granted it
- Granularity allows purpose-specific choices
Document this comparison. If a regulator questions your setup, you'll need evidence of deliberate alignment.
Maintenance and Ongoing Tasks
Quarterly Cookie Inventory Updates
Your cookie landscape changes whenever you add marketing tools, analytics platforms, or third-party integrations. Schedule quarterly audits:
- Export your current cookie list from your CMP
- Run a cookie scanner (OneTrust, Cookiebot, or similar) against production
- Identify discrepancies and update your CMP categorization
Monitor Regulatory Guidance
The CNIL closed this specific injunction but reserved the right to future compliance checks. Subscribe to CNIL updates and EDPB guidance releases. When new recommendations publish, compare them against your current implementation and document any gaps.
Consent Renewal Strategy
Persistent Cookies with long durations may require consent renewal. If you're storing consent for 12 months but cookie purposes change, you need to re-prompt users. Build a consent versioning system that tracks when users last consented and what purposes they agreed to.
Ad Format Reviews
If you display ads within content, review formats whenever you launch new ad placements or partners. The line between "sufficiently distinct" and "misleading" shifts with context. An ad format acceptable in a sidebar might fail in an email inbox.
The CNIL's injunction closure shows that regulators will accept practical fixes when you address their specific concerns with verifiable changes. Your consent infrastructure doesn't need to be perfect on day one, but it does need to be auditable, specific, and genuinely informative. Build that foundation now, before an injunction forces it.
