## Facts

- Privacy NGOs filed group complaints in May 2018 alleging Google’s Android account-creation flow failed GDPR transparency duties and lacked valid consent for ad personalization.
- The processing at issue occurred during Android device setup for French residents and enabled access to multiple Google services.
- Data processed for personalization included location data, browsing history, app usage, and device information, with potential cross-service combination at large scale.
- User information was presented through layered documents and multiple links; CNIL found key information fragmented and difficult to reach.
- Consent settings for personalized advertising were enabled by default and presented through design choices CNIL characterized as opt-out and insufficiently granular.
- CNIL assessed whether the GDPR “one-stop-shop” applied; it concluded Google’s Irish entity did not control purposes and means for the relevant processing, leaving no EU “main establishment” for that processing.
- After online inspections in September 2018, CNIL’s restricted committee imposed a €50 million administrative fine and ordered publication of the decision.
- Google appealed; the French Conseil d’État rejected the appeal and confirmed the sanction in full (June 19, 2020).

## Issues

1. Whether CNIL had jurisdiction to act because Google lacked an EU “main establishment” for the Android account processing, making the one-stop-shop mechanism inapplicable.
2. Whether Google’s layered notices satisfied GDPR duties to provide concise, transparent, intelligible, easily accessible, and complete information about processing (including purposes, data categories, and retention).
3. Whether Google obtained valid consent for ad personalization that was freely given, specific, informed, unambiguous, and reflected a clear affirmative act.
4. Whether a €50 million fine and publication order were proportionate under GDPR sanction criteria.

## Decision

- CNIL held it was competent because no EU entity had decision-making power over the relevant processing purposes and means for the Android account flow.
- CNIL found violations of GDPR transparency and information obligations because information was dispersed across multiple screens/documents and key elements were insufficiently clear or complete.
- CNIL found consent for ad personalization invalid because default-enabled settings, pre-ticked/opt-out mechanisms, bundled purposes, and limited granularity prevented specific and informed opt-in consent.
- CNIL imposed a €50 million fine and ordered publication of the decision (with later anonymization).
- On appeal, the Conseil d’État affirmed CNIL’s jurisdictional analysis, the findings of GDPR violations, and the proportionality of the fine.

## Legal Principles

- A supervisory authority may exercise jurisdiction where the controller lacks an EU “main establishment” for the specific processing, meaning no EU entity actually determines the purposes and means for that processing.
- GDPR transparency requires information to be easily accessible and understandable in context; scattering key disclosures across multiple links/screens can breach information duties, especially for large-scale, intrusive processing.
- Valid consent for advertising personalization requires an opt-in, clear affirmative act; pre-selected options, opt-out designs, and vague or bundled purposes can fail the “freely given, specific, informed, and unambiguous” standard.
- Sanctions may reflect the gravity, duration, scope, number of affected individuals, intrusive character of processing, and the controller’s economic capacity to ensure deterrence.

## Conclusion

CNIL sanctioned Google for failing to provide sufficiently accessible and complete processing information during Android account creation and for relying on consent mechanisms that did not meet GDPR opt-in and specificity requirements for ad personalization; France’s Conseil d’État upheld CNIL’s jurisdiction, liability findings, and €50 million fine.


NOYB & La Quadrature du Net v. Google LLC, CNIL SAN-2019-001 (Fr. Jan. 21, 2019)