Orange has been fined 50 million euros by the CNIL for displaying unauthorized advertisements in users’ emails on its Mail Orange platform without consent. The CNIL deemed this practice a violation of user rights, affecting over 7.8 million subscribers. Additionally, issues with Orange’s cookie management were identified, leading to a mandate to cease cookie activities after consent withdrawal. Orange plans to appeal the decision, arguing the fine is excessive and claiming standard market practices were followed.
Orange Faces Hefty 50 Million Euro Fine from CNIL
In a significant ruling, Orange has been imposed with a staggering fine of 50 million euros by the CNIL, the French data protection authority. This penalty comes as a result of the operator’s unauthorized display of advertisements within the emails of its messaging service users, without their explicit consent.
On December 10, 2024, the CNIL revealed that Orange had been found inserting ads into its Mail Orange platform, effectively placing promotional content between users’ emails in their inboxes. The regulatory body emphasized that such practices violated users’ rights, as obtaining consent is mandated by Article L. 34-5 of the Postal and Electronic Communications Code (CPCE).
Illegal Advertising Practices Under Scrutiny
The CNIL characterized these advertisements as “advertising solicitation by direct mail,” highlighting that they closely resembled actual email communications and occupied a space typically reserved for private conversations. The gravity of the situation was accentuated by the sheer number of affected users, with over 7.8 million subscribers having been exposed to these unsolicited ads.
Furthermore, the authority took into account Orange’s dominant position in the French telecommunications market when determining the fine’s magnitude. It is worth noting that the CNIL could have levied an even larger penalty had Orange not made adjustments to its advertising strategy. Since November 2023, the Mail Orange service has transitioned to a format that distinctly separates promotional messages from real emails.
In addition to the advertising violations, the CNIL also discovered issues regarding Orange’s cookie management practices. The authority found that the company continued to read and send cookies even after users had revoked their consent. Consequently, the CNIL has mandated that Orange halt all cookie-related activities post-consent withdrawal, giving the operator three months to comply or face daily fines amounting to 100,000 euros.
In response to the ruling, Orange has expressed its disagreement with the CNIL’s decision, deeming the fine excessively punitive. The company plans to appeal to the Council of State, asserting that the alleged infractions do not constitute a breach of security and are instead reflective of standard market practices, without any misuse of customer data. Orange also expressed disappointment over not receiving prior notice from the CNIL regarding these issues.