French regulators on Monday hit Google with a $57 million penalty—the first fine targeting a U.S. technology giant under Europe’s strict new data privacy rules.

“This fine should serve as a wake-up call for all companies whose business models are based on data exploitation to take data protection and individuals’ data rights seriously.”
—Ailidh Callander, Privacy International

Implemented across the European Union (EU) in May of 2018, the General Data Protection Regulation (GDPR) aims to bar tech companies from relying on “long illegible terms and conditions full of legalese” to obtain and use data. Under the new rules, “the request for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent.”

Responding to the €50 million penalty levied against Google, Ailidh Callander of Privacy International said, “This fine should serve as a wake-up call for all companies whose business models are based on data exploitation to take data protection and individuals’ data rights seriously.”

France’s digital privacy watchdog, the National Data Protection Commission (CNIL), charges that although Google took some steps to comply with GDPR, it still fails to make data processing information “easily accessible for users” and does not validly obtain consent for showing users personalized ads.

“The infringements observed deprive the users of essential guarantees regarding processing operations that can reveal important parts of their private life since they are based on a huge amount of data, a wide variety of services, and almost unlimited possible combinations,” a statement from CNIL said.

“This is the first time that the CNIL applies the new sanction limits provided by the GDPR,” the statement noted. “The amount decided, and the publicity of the fine, are justified by the severity of the infringements observed regarding the essential principles of the GDPR: transparency, information, and consent.”