Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was inadequately informed to users and did not obtain valid consent. Specifically, CNIL said
Users are not able to fully understand the extent of the processing operations carried out by GOOGLE. But the processing operations are particularly massive and intrusive because of the number of services offered (about twenty), the amount and the nature of the data processed and combined. The restricted committee observes in particular that the purposes of processing are described in a too generic and vague manner, and so are the categories of data processed for these various purposes. Similarly, the information communicated is not clear enough so that the user can understand that the legal basis of processing operations for the ads personalization is the consent, and not the legitimate interest of the company.
Article 6.1 of the GDPR lays out the conditions under which the processing of personal data is lawful. It seems the subparagraphs most relevant to Google's processing of personal data for the purposes of ads personalization are:
6.1.(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
6.1.(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
6.1.(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
It seems that the satisfaction of 6.1.(b) or 6.1.(f) would preclude the need for Google to obtain consent to process personal data. The terms under which Google processes personal data for the use of ads is stated in their Ads Data Processing Terms, with the types of personal data in scope for those terms listed here. If a user registers to Google, personally identifying their searches, are they not also agreeing to these terms, thereby satisfying 6.1.(b)?
Additionally, I don't fully understand why it is not a legitimate interest for Google, an ads-serving company, to process personal data for the purpose of ads personalization?