Background information
- Date of final decision: 14 November 2024
- National case
- Controller: ORANGE
- Legal Reference: Obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code), Cookies read in spite of user consent withdrawal (Article 82 of the French Data Protection Act)
- Decision: Infringement of the French Post and Electronic Communications Code, Infringement of the French Data Protection Act, Administrative fine
- Key words: Commercial prospecting, cookies
Summary of the Decision
Origin of the case
The French telecommunications operator ORANGE provides its customers with an electronic messaging service ("Mail Orange"). Following several investigations, the French Supervisory Authority, CNIL found that the company was displaying advertisements in the form of emails among genuine emails in its users' inboxes.
Key Findings
- Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code)
- Failure to comply with Article 82 of the French Data Protection Act: cookies read in spite of user consent withdrawal
Decision
For these two breaches, the restricted committee decided to impose a sanction on ORANGE, which is composed of:
- an administrative fine of 50 million euros, which was made public.
- an order to stop reading cookies after the withdrawal of consent by the person concerned, within three months, with a fine of 100,000 euros per day overdue.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.