When the CNIL closes an injunction against Google, it doesn't mean all is well. It confirms that two specific tasks were completed. For your compliance team managing advertising consent flows, this September 2026 closure offers a guide to what regulators actually check when they return.
The CNIL's September 23, 2026 decision closed an injunction issued a year earlier with a €325 million fine. Google had six months to fix two issues: inform French users that creating a Google account means accepting advertising cookies, and stop inserting ads disguised as emails in Gmail. They did both, and the injunction closed. However, the CNIL clarified that this doesn't cover the full account creation flow under Article 82 of the loi Informatique et Liberté, and future checks remain possible.
Here's how to build a consent remediation process that survives follow-up inspections.
Why This Matters Now
Supervisory authorities don't issue injunctions randomly. They identify specific failures, demand specific fixes, and return to verify compliance. When they close the injunction, they're confirming you completed the assigned tasks, not that your entire program is compliant.
Google's case shows the detail regulators expect. The CNIL didn't ask for a vague "improve transparency." They required two concrete changes: explicit disclosure that account creation triggers advertising cookies, and visual differentiation of ads from genuine emails. Both changes had to happen within six months or trigger a €100,000 daily penalty.
Your team faces similar dynamics. If your supervisory authority issues corrective measures, you're working against a clock with measurable deliverables. Understanding what "closed" actually means helps you scope the work and prepare for what comes next.
What You Need Before Starting
Before you remediate consent flows under regulatory pressure, gather:
The formal injunction text. You need the exact language describing what must change. Don't work from a press release or internal summary. The CNIL's decision specified "information sufficient to allow users located in France to understand that cookies serving an advertising purpose will necessarily be deposited when they create a Google account." That's your spec.
Your current user journey map. Document every screen, modal, and disclosure in the flow under scrutiny. For account creation, this includes pre-registration landing pages, signup forms, confirmation screens, and first-login experiences.
Your consent management platform's audit log. You'll need to prove what users saw, when, and what choices they made. If your CMP can't produce timestamped records of consent string versions and user interactions, fix that first.
Legal review of alternative implementations. The Gmail ad format change illustrates this: Google modified the presentation so ads no longer resembled emails, eliminating the need for consent under Article L. 34-5 of the French postal and electronic communications code. Sometimes the compliance path isn't "get consent" but "redesign to avoid the trigger."
A validation plan. How will you prove to the supervisory authority that you've complied? Google submitted evidence of the modified account creation flow and the new Gmail ad format. You need screenshots, code samples, or user testing results ready to go.
Step-by-Step Implementation
Step 1: Map the injunction to specific interface elements. For each requirement, identify the exact screen or component that must change. If the order is "inform users that advertising cookies are mandatory," pinpoint where in your flow that statement appears (or doesn't).
Step 2: Draft the disclosure language. Write clear, specific text. Google added information "specifying that the creation of a Google account is conditioned by the deposit of advertising cookies, in exchange for the free service." Your version should name the cookie category, explain the consequence (account creation requires acceptance), and state the trade-off (free service in exchange).
Step 3: Position the disclosure before the commitment point. Users must see this information before they click "Create Account" or equivalent. Burying it in a linked privacy policy doesn't satisfy transparency obligations. The CNIL's closure confirms Google placed this disclosure in the account creation journey itself.
Step 4: Implement technical changes to remove consent requirements. Google's Gmail fix shows this path: they changed ad presentation so ads "now clearly distinguish themselves from genuine emails." When ads no longer masquerade as private messages, consent under electronic communications law isn't required. Examine whether interface changes can reduce your consent surface area.
Step 5: Version and timestamp everything. Deploy changes with clear version identifiers. Your CMP should log when the new flow went live and which users saw which version. If the supervisory authority asks "when did this change take effect?" you need a precise answer.
Step 6: Document the changes in writing. Prepare a compliance memo mapping each injunction requirement to the implemented change. Include before/after screenshots, code comments, and deployment dates. This becomes your evidence package.
How to Verify It Works
Run these checks before declaring compliance:
User testing with the specific disclosure. Have five people outside your team complete the account creation flow. Ask them to explain, in their own words, what happens with advertising cookies when they sign up. If they can't articulate "I have to accept advertising cookies to create an account," your disclosure isn't clear enough.
Cross-device and cross-locale testing. The injunction covered "users located in France." Verify the disclosure appears correctly for French IP addresses, French language settings, and mobile devices used in France. Don't assume your geolocation logic works until you've tested it.
Consent string inspection. Use your browser's developer tools to examine the consent string stored after account creation. Verify it reflects the advertising cookie acceptance and includes the correct timestamp and version identifier.
Legal sign-off on alternative implementations. If you've redesigned to avoid a consent trigger (like Google's Gmail ad format change), have your DPO or external counsel confirm the new design doesn't require consent under the relevant legal provision. Don't rely on engineering judgment alone.
Ongoing Tasks
Monitor for scope creep in future audits. The CNIL's closure explicitly states it "does not prejudge the CNIL's analysis of the conformity of the entirety of the Google account creation journey" with all provisions of Article 82. They're reserving the right to examine other aspects of the flow. Track any new guidance or enforcement actions that might expand the compliance perimeter.
Log supervisory authority communications. If your authority sends follow-up questions or requests additional information, treat these as early warning signals. Google's six-month remediation window started with a formal injunction, but informal inquiries often precede formal action.
Review consent flows quarterly. Don't wait for the next injunction. Every quarter, have your DPO and a UX designer walk through your consent flows together. Ask: "If the supervisory authority reviewed this screen today, what would they flag?" Document the review and any changes made.
Prepare for the return visit. The CNIL stated it "reserves the possibility of carrying out other checks in the future and, if necessary, mobilizing the full scope of its enforcement powers." Treat injunction closure as intermission, not finale. Keep your evidence package current, maintain audit logs, and assume they'll be back.
When the supervisory authority closes an injunction, you've met the minimum. The question is whether you're ready for the maximum scrutiny that follows.
