Regulator announcement; this article does not establish payment or the outcome of any subsequent appeal.
What happened
On 1 September 2025, CNIL imposed fines totalling €325 million on Google entities. It addressed advertisements appearing among Gmail messages without prior consent and invalid advertising-cookie consent in the account-creation journey. Different French provisions applied to these practices. The total should not be described as a fine solely for a missing Reject button.
Source: CNIL — original source ↗
What it means for your website
For a smaller website, the useful design question is whether a person understands what they are choosing. A brightly coloured approval button, an unclear alternative and vague wording can steer people without giving a meaningful explanation. Review registration screens as well as the homepage banner. Optional marketing choices should be understandable at the moment they are made. A designer, marketer and developer should walk through the same journey together: the words, button behaviour and underlying scripts all need to tell the same story. Copying a large platform’s interface is not evidence that your own setup is appropriate.
Three useful next steps
- Review consent wording at account creation.
- Make alternatives understandable and easy to find.
- Match the recorded choice to the scripts that run.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
CNIL — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.