Google Fined €325M for Cookie Consent Violations

EU GDPRDecember 20, 20228 min read

# Google Fined EUR 325M for Cookie Consent Violations

The Commission Nationale de l'Informatique et des Libertes (CNIL), France's data protection authority, imposed a EUR 325 million fine on Google in December 2022 for systematic cookie consent violations across its advertising ecosystem.

The investigation found that Google deployed deceptive design patterns (dark patterns) that made accepting all advertising cookies significantly easier than refusing them, in direct contravention of GDPR consent requirements under Articles 5(1)(a), 6, and 7. This enforcement action built upon earlier CNIL actions against Google and represented a landmark ruling on the intersection of cookie consent, advertising technology, and the ePrivacy Directive.

## Key Facts

• .**What:** Google used dark patterns making cookie refusal harder than acceptance.
• .**Who:** EU users of Google Search, YouTube, Gmail, and Google Maps.
• .**Data Exposed:** Browsing behavior, ad profiles, and cross-service tracking data.
• .**Outcome:** CNIL fined Google EUR 325M for cookie consent violations.

## What Happened

The CNIL launched its investigation into Google's cookie consent practices following the authority's updated guidelines on cookies and trackers, published in October 2020, which explicitly required that refusing non-essential cookies must be as easy as accepting them.

The investigation examined Google's consent interfaces across its major European services - Google Search, YouTube, Gmail, and Google Maps - and found a systematic pattern of deceptive design that steered users toward accepting all advertising cookies.

Google's consent banner presented a prominent, clearly labeled "Accept All" button at the first interaction layer.

Refusing cookies required navigating through multiple sub-menus, reading through lengthy descriptions, and clicking through several additional screens - a process that CNIL determined was deliberately asymmetric.

" The CNIL also found that Google failed to provide clear information about the purposes of each cookie category before requesting consent, instead using vague labels such as "personalization" that obscured the extent of cross-service tracking.

The EUR 325 million fine was imposed in December 2022 under Deliberation No. SAN-2022-023. This followed CNIL's earlier EUR 150 million fine against Google LLC (Deliberation No. SAN-2022-008) for similar cookie consent issues earlier that year.

Google did not formally appeal the decision but committed to redesigning its cookie consent flows across European services.

The CNIL noted that against Google's annual advertising revenue exceeding EUR 200 billion, the fine remained proportionate under Article 83(2), which allows penalties up to 4% of annual worldwide turnover.

## What Was Exposed

• .User browsing behavior across Google Search, YouTube, Gmail, and Google Maps collected via advertising cookies without valid consent
• .Advertising targeting profiles constructed from cross-service tracking, including search queries, video watch history, and email content signals
• .Third-party cookie data shared with Google's advertising partners through the DoubleClick and Google Ads ecosystem
• .Device fingerprinting data including browser type, screen resolution, installed plugins, and timezone used to supplement cookie-based tracking
• .Geolocation and IP-derived location data used for local advertising targeting without granular consent

## Regulatory Analysis

CNIL's enforcement action addressed violations across both the GDPR and the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC), specifically Article 5(3) which governs the storage of and access to information on a user's terminal equipment.

Under French law, this is transposed through Article 82 of the Loi Informatique et Libertes.

The central finding was that Google's cookie consent interface violated the GDPR's requirements for valid consent as defined in Article 4(11) and elaborated in Article 7. The CNIL determined that consent was neither "freely given" nor obtained through a "clear affirmative action" because Google's consent banner presented a prominent "Accept All" button at the top level while burying the refuse option behind multiple clicks and sub-menus.

This asymmetry constituted a dark pattern that materially influenced user behavior toward acceptance.

The CNIL further found violations of Article 5(1)(a)'s transparency principle, as Google failed to provide clear and comprehensive information about the purposes of each category of cookie before requesting consent.

Users were presented with vague descriptions such as "personalization" without adequate explanation of the extent of cross-service tracking involved.

The legal basis under Article 6 was consequently vitiated: consent obtained through deceptive design cannot constitute a valid legal basis for processing.

This decision followed CNIL's earlier EUR 150 million fine against Google LLC (Deliberation No. SAN-2022-008) for similar cookie consent issues, and reflected the CNIL's updated guidelines on cookies and trackers published in October 2020. The guidelines explicitly require that refusing cookies must be as easy as accepting them--a principle Google's interface demonstrably failed to meet.

Google did not formally appeal the decision but committed to redesigning its cookie consent flows across European services.

The CNIL's restricted committee (formation restreinte) noted that Google's significant revenue from advertising--over EUR 200 billion annually--meant the fine, while substantial in absolute terms, remained proportionate under Article 83(2) which allows fines up to 4% of annual worldwide turnover.

## What Should Have Been Done

Google should have implemented a consent management platform that presented accept and refuse options with equal prominence at the first layer of the consent interface.

The CNIL's guidelines are unambiguous: if a single click can accept all cookies, a single click must also be available to refuse all non-essential cookies.

This principle should have been implemented across all Google services accessible from the EU, with consistent design patterns that do not vary by service or user segment.

The information provided to users at the point of consent collection should have included clear, specific descriptions of each cookie category, the purposes of processing, the identities of third-party recipients, and the retention periods.

Rather than grouping all advertising cookies under vague labels, Google should have provided granular controls allowing users to consent to specific advertising purposes independently.

The EDPB's Guidelines 05/2020 on consent require that consent be "specific" to each purpose, meaning bundled consent for all advertising purposes is insufficient.

From an organizational perspective, Google should have conducted a Data Protection Impact Assessment (DPIA) under Article 35 for its advertising cookie ecosystem, given the large-scale, systematic monitoring of data subjects involved.

The company should have established a dedicated consent engineering team responsible for ensuring that all user interfaces comply with evolving regulatory guidance across EU member states.

Regular audits of consent collection rates--comparing acceptance rates across different interface designs--should have been conducted to identify and eliminate dark patterns before they attracted regulatory attention.

Technical measures should have included implementing a robust consent signal that propagated across all Google services and third-party integrations, ensuring that a user's refusal on one Google property was respected across the entire ecosystem.

Server-side enforcement mechanisms should have been deployed to prevent cookie placement or data collection when valid consent had not been obtained, rather than relying solely on client-side JavaScript controls that could fail or be circumvented.

The EUR 325M Google fine demonstrates that cookie consent is not a UX problem to be optimized for acceptance rates--it is a legal obligation that requires genuine user choice.

Any organization deploying advertising cookies must ensure that refusing tracking is exactly as easy as accepting it, with no dark patterns, no buried options, and no asymmetric design.