The unlawfulness of a Google My Business listing without consent.

Case law regarding personal data protection continues to evolve under the impetus of the GDPR and the practices of digital giants. The ruling issued on May 22, 2025 by the Chambéry Court of Appeal (n° 22/01814) \\ [1\\] marks a significant turning point in the power dynamic between professionals subject to a Google My Business (GMB) listing created without their consent, and platforms that monetize their data for commercial purposes.

This article analyzes this decision, structured around three axes: the lawfulness of Google's processing of personal data (I), the rejection of legitimate interest as a legal basis (II), and the recognition of the right to erasure based on the GDPR (III).

I. A Google My Business listing constitutes personal data processing subject to the GDPR.

The ruling unambiguously confirms the applicability of the GDPR to a professional listing, insofar as it allows for the identification of a natural person. Contrary to Google's argument, the fact that Ms. \\[C\\] practices in the form of a SELARL does not negate the personal nature of the data: name, surname, profession, and contact details allow for direct identification.

The court also rejects the alleged lack of sensitivity of the data: even if professional, they do not escape the qualification of personal data. This analysis complies with Article 4 §1 of the GDPR.

Finally, the data was collected without consent, through data sourced from Infobel and Orange, without Ms. \\[C\\] being informed, which violates Article 14 of the GDPR. The absence of initial information deprives Ms. \\[C\\] of the effective exercise of her right to object.

II. Legitimate interest cannot justify non-consented processing to the detriment of fundamental rights.

Google invoked Article 6 §1 f) of the GDPR to justify the creation of the GMB listing, arguing a legitimate interest in informing the public. The court performed a three-part analysis, consistent with the guidelines of the European Data Protection Board: legitimacy of the interest, necessity of the processing, and balancing with the rights of the data subject.

- The informative purpose is real, but it is not exclusive; - The underlying commercial objective is established (proposal of paid services, creation of a Google account conditioning access to the management of the listing); - The coercive effect on Ms. \\[C\\], forced to create an account to dispute reviews, is deemed disproportionate.

The court recalls that health professionals are subject to medical secrecy, which makes the exercise of their right of reply even more delicate. The lack of verification of review authors reinforces the imbalance, especially since some are anonymous or come from third parties who are not patients.

The court therefore finds that the processing is not proportionate to the rights of Ms. \\[C\\] and declares legitimate interest inoperative. The processing is thus deemed unlawful.

III. The right to erasure enshrined in Article 17 of the GDPR: an effective weapon against unsolicited listings.

The direct consequence of the unlawfulness of the processing is the recognition of the right to erasure provided for in Article 17 §1 d) of the GDPR. Ms. \\[C\\] is entitled to obtain the deletion of her GMB listing.

The invoked exceptions (freedom of expression and information) are rejected: the court considers that the anonymity of reviews, their lack of verification, and the constraints induced by their removal, render these freedoms inoperative in this context.

The court awards Ms. \\[C\\] 10,000 euros in compensation for moral prejudice.

It recognizes a direct link between the fault (lack of information, forced creation of the listing, impossibility of objection) and the damage.

Conversely, the grievances of disparagement and freeloading are rejected. Google, as a host, did not breach its obligations under Article 6 of the LCEN, as the statements were not manifestly unlawful. As for freeloading, Ms. \\[C\\] did not demonstrate direct economic exploitation or a loss of activity.

Conclusion.

The Chambéry Court of Appeal rigorously applies the GDPR and reaffirms that personal data protection takes precedence over algorithmic monetization strategies. Professionals now have a solid precedent to challenge the creation of GMB listings without consent and demand their deletion. In this respect, this decision constitutes a remarkable advance for the digital sovereignty of individuals against systematized commercial profiling practices.

Partner lawyer - Intellectual Property and Digital Law