CNIL brands ad personalisation consent invalid, slams lack of transparency
Google has been fined a mammoth €50m by the French data protection watchdog for GDPR violations in a victory for Max Schrems' privacy group NOYB.
The French agency, CNIL, ruled today that the search giant had offered users inadequate information, spreading it across multiple pages, and had failed to gain valid consent for ads personalisation.
Acting on a complaint from NOYB and French group La Quadrature du Net, the agency said it had investigated the process for setting up a Google account from an Android device.
The CNIL concluded that Google had breached the General Data Protection Regulation in two ways: by failing to meet transparency and information requirements, and failing to obtain a legal basis for processing.
Under the law, it can award fines of up to €20m or 4 per cent of annual turnover – and it has wielded the new power with aplomb, handing out a €50m penalty.