French DPA fines Orange €50M for displaying ads between emails

The Commission Nationale de l'Informatique et des Libertés (CNIL) has imposed a €50 million fine on Orange for displaying advertisements between emails without users’ consent.

Telecommunications operator Orange provides its customers with an electronic service called Mail Orange. The French data protection authority (DPA) found that the company was displaying advertisements among emails in users’ inboxes in a way that the ads looked like genuine emails.

However, this happened without the permission of its users, which is required according to the French Post and Electronic Communications Code (CPCE).

Furthermore, CNIL’s investigation revealed that when visitors of the orange.fr website withdrew their consent to read previously stored cookies on their devices, the company kept reading their cookies. That’s a violation of Article 82 of the French Data Protection Act, which prohibits reading stored cookies when consent is withdrawn, even if this data isn’t used.

Orange had to implement technical solutions that prevented previously stored cookies from being read. The same goes for ads that were placed by Orange’s partners.

For these violations, CNIL laid down an administrative fine of €50 million on Orange. In addition, the French DPA ordered the telecom operator to stop reading cookies after a visitor withdrew his consent. Orange has three months to comply, or else it has to pay a fine of €100,000 per day.

The amount of the fine was decided on the fact that over 7.8 million people have seen the advertisements in their inboxes. Also, Orange is considered as France’s leading telecommunications operator. Lastly, the DPA took into consideration the financial advantage Orange gained from displaying the ads.

The CNIL acknowledges that Orange has ceased to display this type of advertisement since November 2023. The company also implemented a new advertising design, making a clear distinction between genuine emails and ads. But that’s too little, too late to avoid the fine.

According to the French news outlet Le Monde, a spokesperson of Orange called the administrative fine “totally disproportionate” in a statement to press agency AFP. The advertisements represented “neither a breach nor a lapse in security but common market practice that did not involve any use of customers’ personal data,” he said. Therefore, Orange is going to appeal the CNIL’s decision.