⚠️
Action required. If your organisation operates authenticated user environments (logged-in portals, apps, or services) across multiple devices, the new CNIL multi-device consent rules apply to you. Non-compliance risks are now significant — Google’s €325M fine is a clear signal of intent.
01 — Background
Six Years of CNIL Cookie Enforcement
The CNIL’s structured enforcement plan on cookies and trackers — launched in 2019 — has steadily escalated in both scope and financial impact. What began as a framework-building exercise has become one of Europe’s most consequential data protection enforcement programmes.
2019
CNIL launches structured enforcement plan on cookies and trackers across French-market operators.
2021
Google fined €150M, Facebook €60M — reject buttons missing or harder to access than accept buttons.
2022
Amazon fined €35M. CNIL publishes updated cookie guidelines. Consent Management Platforms (CMPs) come under scrutiny.
2023–2024
CNIL broadens enforcement to mid-size operators. Over 100 formal notices issued. Cross-border cooperation with other DPAs intensifies.
September 2025 🔴
Google fined €325M for Gmail ad insertion without consent + invalid cookie mechanism during account creation.
December 2025 🟢
CNIL publishes final multi-device consent recommendations — binding rules for authenticated environments across all devices.
🔍 The €325M Google Fine — Breakdown
€325,000,000
CNIL · September 2025 · Two separate violations
📧
Gmail Ad Insertion
Displaying targeted advertisements inside Gmail inboxes without obtaining prior, explicit user consent under Article 82 of the French Data Protection Act.
🔐
Account Creation Cookies
Placing advertising cookies during Google account creation without a valid consent mechanism — treating account registration as implicit consent.
The scale of this fine reflects a clear regulatory message: no organisation is too large to be held accountable, and “it’s always been done this way” is not a defence. The two violations address patterns that are widespread across the industry — ad integration in communication tools and consent bypass during onboarding flows.
📊 CNIL Cookie Enforcement — Historical Scale
Gmail ads + account creation cookies
Consent mechanism harder to refuse than accept
Cookies placed before consent
02 — New Rules
Multi-Device Consent: The New Framework
Published in December 2025, the CNIL’s final recommendations on multi-device consent establish — for the first time — a clear legal framework for how consent can be collected, propagated and documented across multiple devices for authenticated users.
🔑 Core principle: Consent given on one device may be extended to other devices — but only if the user was clearly informed, the propagation is technically traceable, and the original consent record is preserved per device.
📱 How Multi-Device Consent Works
✅ Consent given on Device 1
💻
Desktop
Consent collected here
→
📱
Mobile App
Propagated if conditions met
→
📺
Smart TV
Propagated if conditions met
- 🔒
Authenticated only. Rules apply exclusively to logged-in users. Anonymous/unauthenticated sessions are out of scope and must be treated separately.
- 🔍
Full transparency required. Users must be explicitly informed that their consent on one device will apply across all other devices linked to their account.
- 📋
Traceable chain of proof. You must be able to prove: when consent was given, on which device, in which context, and how it was propagated — with timestamps per device.
- ↩️
Withdrawal must be universal. If a user withdraws consent on one device, it must be withdrawn across all linked devices immediately.
- ⏰
Renewal cadence. Consent does not last indefinitely. The CNIL recommends re-asking at reasonable intervals consistent with your original consent terms.
03 — Action Plan
What Your Organisation Must Do Now
These developments translate into four concrete operational priorities for DPOs and compliance teams. Each has a different urgency level and technical complexity — but all are now required for defensible compliance.
ACTION 01
🍪
Audit your cookie banners
Verify that the reject mechanism is equally prominent and accessible as the accept button. Any asymmetry — visual or UX — is now a documented enforcement trigger. Test on mobile and desktop.
ACTION 02
⚙️
Update your CMP
If you run an authenticated service, your Consent Management Platform must now handle multi-device propagation logic. Validate that your CMP vendor supports the December 2025 CNIL framework.
ACTION 03
📁
Document consent per device
Build or update your consent logs to capture: device type, timestamp, consent scope, propagation events, and withdrawal events — per user, per device. This is now your primary proof of compliance.
ACTION 04
📄
Review ad-tech contracts
If you work with advertising technology processors, review your DPAs. Obligations flowing from the CNIL’s ruling must be mirrored in processor contracts — especially around consent signal transmission.
⚠️ The 3 Lessons From the Google Fine
Lesson 1 — Context matters for ads
Inserting advertising inside a messaging or communication interface (like Gmail) requires explicit, prior consent — even if the user agreed to general advertising cookies elsewhere. The context of the placement creates a separate consent obligation.
Lesson 2 — Registration ≠ Consent
Creating an account with a service does not constitute consent to advertising cookies. Account creation and cookie consent must be entirely separate flows with separate, unambiguous actions.
Lesson 3 — France = All of Europe
The CNIL expects that fixing a French compliance gap means updating practices across all EU operations. A “France-only fix” is not a valid response to a CNIL enforcement action if you operate a pan-European service.
🛡️
Need a Cookie Compliance Audit?
DPO Advisors can review your consent architecture, CMP configuration, and documentation framework against the latest CNIL requirements — in under 2 weeks.
Talk to our experts →
🛡️
DPO Advisors
Published January 2026 · dpoadvisors.com · contact@dpoadvisors.com
