GOOGL Alphabet Inc

By Sam Schechner 

Alphabet Inc.'s Google was fined 50 million euros ($57 million) by a French regulator--the biggest penalty levied yet under a new European privacy law--alleging the search-engine giant didn't go far enough to get valid user consent to gather data for targeted advertising.

The fine is one of the highest profile regulatory actions stemming from the European Union's "General Data Protection Regulation," which went into effect in 2018. The law requires companies to abide by strict data-protection and privacy rules protecting consumers in Europe.

A big part of the new rules is that companies must explain to users how their data is being collected and used and in many cases, seek consent from users to collect it.

"People expect high standards of transparency and control from us. We're deeply committed to meeting those expectations and the consent requirements of the GDPR. We're studying the decision to determine our next steps," a Google spokesman said.

The fine is small for Google, but it is by far the biggest penalty issued so far by any of the national regulators with authority to use GDPR to redress what they deem as insufficient data or privacy protection.

It also represents the starting pistol of what many observers say could be a raft of regulator actions as officials wield the new legal tool--and potentially test its bounds.

Monday's ruling focused on how easy to find and how complete was the information Google provided to consumers to inform their consent for the use of their data.

France's National Data Protection Commission said Google violated rules requiring information about data collection to be transparent. It said full information about things like data-processing purposes and data-storage time periods weren't presented in the same place--in some cases requiring up to five or six clicks. It said that some boxes to give consent were already checked, meaning the consent wasn't affirmative, and said this was a violation of the law.

The agency said Google hadn't obtained appropriate user consent for personalized ads on its platforms. It said such user consent wasn't "sufficiently informed," because of a lack of information about how the company used the data to personalizes its ads.

Write to Sam Schechner at sam.schechner@wsj.com

(END) Dow Jones Newswires

January 21, 2019 11:15 ET (16:15 GMT)

Copyright (c) 2019 Dow Jones & Company, Inc.