Alphabet Inc.’s Google lost its fight over a 50 million-euro (US$56 million) privacy fine in France -- the biggest penalty levied so far under the European Union’s beefed-up data-protection rules.

France’s top administrative court ruled on Friday that Google didn’t deliver sufficiently clear and transparent information to Android users and didn’t give them a chance to deliberately consent to their private data being processed to personalize adverts.

The fine issued by France’s data authority CNIL in January 2019 was by far the biggest levied under the EU’s General Data Protection Regulation, or GDPR. The EU measures took effect in May 2018 and gave national privacy regulators powers to fine companies as much as 4 per cent of global annual sales for the most serious violations.

In Friday’s ruling, the Conseil d’Etat considered the 50 million-euro fine wasn’t disproportionate, given the particular seriousness of the wrongdoing.

Google said in a statement it “will now review what changes we need to make.”

“People expect to understand and control how their data is used, and we’ve invested in industry-leading tools that help them do both,” the company said. “This case was not about whether consent is needed for personalized advertising, but about how exactly it should be obtained.”

Google has come under CNIL’s scrutiny many times before, but under the old rules, fines couldn’t exceed the maximum of 150,000 euros.

In a separate ruling, the Conseil d’Etat said CNIL had no right to ban so-called cookie walls, whereby access to a website is blocked if cookies are refused.