The two shortcomings identified by the CNIL in 2025

On September 1, 2025, the CNIL’s restricted panel issued an injunction against Google LLC and Google Ireland Limited, in addition to a €325 million fine imposed for practices deemed non-compliant with the General Data Protection Regulation (GDPR). Two specific points had been targeted:

• The lack of clear information about the deposit of advertising cookies when creating a Google account. According to the CNIL, users were not sufficiently informed about the use of their data for advertising purposes from the moment of registration.
• The insertion of advertising emails within Gmail without visual distinction from private messages. While this practice is now regulated by Article L. 34-5 of the Postal and Electronic Communications Code, it required explicit user consent, which was previously absent.

Failure to correct these issues within a year would have exposed Google to a daily penalty of €100,000, a financial risk that likely accelerated the adjustments.

The companies met the demands within the allotted time, but the CNIL emphasizes that this compliance remains partial and does not cover all of their legal obligations.

The corrections made by Google to lift the injunction

According to the closure decision of September 23, 2026, Google met the two requirements within the allotted time. The CNIL’s restricted panel highlights two key changes:

• Transparency on advertising cookies: when creating a Google account, users are now explicitly informed that opening an account involves the deposit of cookies for advertising purposes. This information is integrated into the registration process, in line with GDPR expectations regarding informed consent.
• Clear distinction between ads and private emails in Gmail: promotional messages inserted into Gmail inboxes are now visually and functionally separated from personal emails. According to the CNIL, this separation allows for the consideration that users’ consent is no longer required, under Article L. 34-5 of the Postal Code, which governs commercial electronic communications.

The CNIL clarifies, however, that this closure only covers the scope defined in 2025. Other aspects of the Google account creation process may still be subject to checks, particularly under the Article 82 of the Computer and Freedoms Act, which strengthens data protection obligations.

The limits of this compliance: what the CNIL continues to monitor

While the closure of the injunction marks a milestone, it does not signify a full validation of Google’s practices. The CNIL explicitly reserves the right to conduct further checks on the compliance of the entire account creation process, beyond the two points initially sanctioned. Several elements suggest heightened vigilance:

• The closure decision does not preclude a future analysis of full compliance with the provisions of Article 82 of the Computer and Freedoms Act, which imposes strict requirements in terms of data processing security and transparency.
• Digital giants must adapt to these changes, or risk facing new sanctions.
• African users, often less aware of data protection issues, could continue to be exposed to opaque practices if digital giants do not globally implement these corrections.

The CNIL thus emphasizes that this closure is temporary and does not exempt Google from complying with all current legal obligations.

What this means here: implications for businesses and administrations in West Africa

Although this CNIL decision directly concerns European Google users, it could have indirect repercussions for West African businesses and administrations, where cloud services and email tools like Gmail are widely adopted. Here’s what this case could inspire locally:

• Strengthening transparency requirements: organizations using international platforms like Google may be encouraged to audit their own practices regarding cookie management and consent. As regulations similar to GDPR emerge in Africa (such as the data protection bill in South Africa or initiatives by the African Union), Beninese or West African companies should anticipate increased scrutiny of their digital tools’ compliance.
• Adaptation of professional email policies: government agencies and businesses using Gmail for internal exchanges or with citizens may reassess the separation between private and promotional communications. While Google has addressed this issue in Europe, there is no guarantee that the same adjustments have been applied to African users, where practices may vary depending on regional servers.
• Increased user awareness: this case highlights the importance for local organizations to train their employees and partners on data protection issues. European sanctions demonstrate that tech giants are under close scrutiny, and African users, often less informed, could be the first victims of non-compliant practices.
• Opportunity for local alternatives: this decision could encourage African players to develop messaging and cloud storage solutions compliant with local regulations, thereby reducing dependence on foreign platforms. Initiatives like Africastalking or government projects (such as the Beninese national cloud, if it materializes) could gain relevance against giants like Google.
• Preparing for future audits: companies using cloud tools (such as Google Workspace, Microsoft 365, or AWS) should document their configurations to prove compliance with emerging regulations. In the long term, authorities like the Benin Data Protection Authority (if established) may draw inspiration from European decisions to penalize similar breaches.

Finally, this case illustrates that compliance with data protection regulations is not a one-time process, but a continuous commitment. For West African organizations, this could mean integrating regular audits and updating their data policies as part of their digital strategy.