The fines issued in 2025 — €325M against Google, €150M against SHEIN, and €900,000 against SOLOCAL — confirm a toughening of the CNIL's enforcement policy.
The most significant development, however, lies in the method of calculating fines: the CNIL now considers the group's worldwide turnover, both for GDPR infringements and those related to ePrivacy regulations. This change significantly alters risk assessment for corporate groups.
1. What changes in 2025
The concept of “undertaking” within the meaning of competition law
Recital 150 of the GDPR states that:
“Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes”.
The EDPB guidelines on administrative fines recall that the concept of undertaking corresponds to:
“an economic unit that can be formed by the parent company and all the subsidiaries concerned”.
The CJEU, in a judgment of December 5, 2023, reaffirmed that the amount of the fine must be calculated according to the real economic capacity of the responsible party, which leads to the economic unit being considered and not the isolated legal entity.
The practical application by the CNIL in its 2025 sanctions decisions
First example: Google (SAN-2025-004)
The restricted committee highlights:
“When a subsidiary is 100% owned by its parent company, there is a rebuttable presumption of decisive influence. [...] It is necessary to take into account the turnover of the parent company in order for the fine to be effective, proportionate and dissuasive”.
And it specifies:
“ALPHABET Inc. generated more than $350 billion in sales in 2024”.
In conclusion, the CNIL takes into account ALPHABET's turnover and not that of Google France or GIL.
Second example: SHEIN (SAN-2025-005)
The CNIL also upholds the principle of economic unity:
“ROADGET BUSINESS PTE LTD wholly owns INFINITE STYLES SERVICES CO LIMITED. [...] The group's parent company's turnover should be used”.
Again, the CNIL uses the worldwide turnover of the Singaporean company to calculate the fine.
The Google and SHEIN decisions confirm that worldwide turnover is now the CNIL's reference method whenever the conditions are met. This approach also applies to cookie-related sanctions. On this point, see our analysis of the Orange, SHEIN, Condé Nast and American Express decisions.
2. Implications for organizations
Increased financial exposure
The logic is now clear: even if the breach is committed by a local subsidiary, the fine can be calculated based on the group's consolidated turnover.
The revenue base is not limited to turnover resulting from breaches
The CNIL expressly states this in the Google decision:
“No text limits the basis to only turnover resulting from breaches. [...] It is appropriate to rely on total turnover”.
In other words:
→ the seriousness of the breach is not linked to the revenue generated,
→ economic capacity is the only thing that counts.
3. Operational lessons for groups
Reassess your financial exposure
Integrate the group's global turnover into your risk analyses, and no longer just that of the French entity or subsidiary concerned. A local failure can now cost tens or even hundreds of millions of euros if you are part of an international group.
Strengthen group governance
Establish control and supervision mechanisms at the parent company level to ensure the compliance of all subsidiaries. The presumption of decisive influence comes into play when the subsidiary is 100% owned by its parent company.
Document autonomy (if applicable)
If a subsidiary operates in a truly autonomous manner, document this autonomy in an attempt to overturn the presumption of decisive influence of the parent company. Warning: this presumption is rebuttable but difficult to overturn.
Treat cookies with the same level of requirement as the GDPR
Cookie breaches now carry the same level of sanctions as GDPR breaches.
Conclusion: a major shift
The sanctions imposed by the CNIL in 2025 mark a turning point: the calculation of fines based on the group's turnover, including for ePrivacy breaches (cookies and electronic prospecting), multiplies the financial exposure of international groups.
The era of symbolic sanctions is definitely over. The CNIL now has the legal and methodological tools to impose truly dissuasive sanctions, calibrated to the real economic size of the sanctioned groups.
For international organizations, compliance is becoming a strategic and budgetary imperative. Legal departments, DPOs and general management must integrate this new approach into their governance, risk analyses and compliance budgets.
For an analysis of the CNIL's main enforcement trends, see also our article "The CNIL's targeted enforcement policy: review of the 2025 Sanctions".
