Google Search operates under Alphabet Inc.'s umbrella privacy policy, which discloses broad collection of search, ad-interaction, and cross-device data used to power personalized advertising, and describes controls such as My Activity and Ad Settings that let users review or limit some of this collection. Google states in its own materials that it does not sell personal information and limits sharing of personally-identifying data with advertisers, but regulators in the U.S. and France have repeatedly found that Google's consent and transparency practices around tracking and ad personalization fell short of legal requirements, resulting in a multi-decade track record of FTC and CNIL enforcement actions. Alphabet's corporate ownership chain is publicly disclosed through SEC filings, though a dual-class share structure concentrates voting control with the company's founders.
TRACK RECORD
4 ENFORCEMENT ACTIONS
[2025-09-01]
On September 1, 2025, France's CNIL fined Google a total of €325 million for displaying advertisements between Gmail users' emails without their consent and for placing cookies during Google account creation without valid consent.
In 2019, the FTC and the New York Attorney General announced that Google and YouTube would pay $170 million total ($136 million to the FTC, $34 million to New York) to settle allegations that YouTube collected children's personal information without parental consent in violation of COPPA.
On January 21, 2019, France's CNIL imposed a €50 million financial penalty on Google LLC under the GDPR for lack of transparency, inadequate information, and lack of valid consent regarding ads personalization.
In 2012, the FTC announced that Google agreed to pay a record $22.5 million civil penalty to settle charges it misrepresented to Safari browser users that it would not place tracking cookies or serve targeted ads to them.
Google's privacy policy states it collects information about views and interactions with ads in order to provide aggregated reports to advertisers, and may measure other on-page interactions.
Alphabet Inc.'s SEC filing discloses that as of October 2, 2015, Alphabet became the successor issuer to, and parent holding company of, Google, with Google's shares converted into Alphabet shares.
Analysis of Alphabet's share structure and SEC disclosures indicates that co-founders Larry Page and Sergey Brin retain majority voting control of the company through Class B supervoting shares despite holding a much smaller proportion of total equity.
Google states in its safety-center materials that it maintains a strict policy of never selling personal information and does not share information that personally identifies a user with advertisers unless the user initiates that sharing.
An earlier version of Google's privacy policy disclosed that Google may share non-personally identifiable information publicly and with partners such as publishers, advertisers, or connected sites.
In 2012, the FTC announced that Google agreed to pay a record $22.5 million civil penalty to settle charges it misrepresented to Safari browser users that it would not place tracking cookies or serve targeted ads to them.
On January 21, 2019, France's CNIL imposed a €50 million financial penalty on Google LLC under the GDPR for lack of transparency, inadequate information, and lack of valid consent regarding ads personalization.
In 2019, the FTC and the New York Attorney General announced that Google and YouTube would pay $170 million total ($136 million to the FTC, $34 million to New York) to settle allegations that YouTube collected children's personal information without parental consent in violation of COPPA.
On September 1, 2025, France's CNIL fined Google a total of €325 million for displaying advertisements between Gmail users' emails without their consent and for placing cookies during Google account creation without valid consent.
Google's privacy policy states that even when browsing in Chrome Incognito mode, third-party sites and apps that integrate Google services still share information with Google when visited.
Google's privacy policy discloses that it may use a user's IP address to determine approximate location in order to serve location-relevant ads, such as for a pizza search.