Google must pay €50 million for GDPR violations, France says

Google has been fined €50 million (~$57 million) by French regulators, the first major penalty under a sweeping new European Union privacy law known as GDPR, which took effect last year.

According to the French government agency, known by the acronym CNIL, Google is still in breach of the law.

CNIL explained that Google had violated two provisions of the law: first by not making its data-collection policies easily accessible enough and second by not obtaining sufficient and specific user consent for ad personalization across each of Google’s numerous services, including YouTube, Google Maps, and more.

"It is not a one-off, time-limited, infringement," the agency said Monday.

The two complaints were filed jointly on the day the law went into effect by the French digital advocacy group La Quadrature du Net and the group Noyb.eu, a watchdog organization started by Max Schrems. The young Austrian privacy activist has been tangling with Silicon Valley giants—notably Google and Facebook—for years.

"Following the introduction of GDPR, we have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products," Schrems said in a statement. "It is important that the authorities make it clear that simply claiming to be compliant is not enough."

Noyb, an English acronym for "None of your business," has also filed related complaints against Instagram, WhatsApp, and Facebook, which remain pending.

Google did not immediately respond to Ars’ request for comment, but it told The Washington Post in a statement that it is "deeply committed to meeting those expectations and the consent requirements of the GDPR."