Background information

• Date of final decision: 14 November 2024
• National case
• Controller: ORANGE
• Legal Reference: Obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code), Cookies read in spite of user consent withdrawal (Article 82 of the French Data Protection Act)
• Decision: Infringement of the French Post and Electronic Communications Code, Infringement of the French Data Protection Act, Administrative fine
• Key words: Commercial prospecting, cookies 

Summary of the Decision

Origin of the case 

The French telecommunications operator ORANGE provides its customers with an electronic messaging service ("Mail Orange"). Following several investigations, the French Supervisory Authority, CNIL found that the company was displaying advertisements in the form of emails among genuine emails in its users' inboxes.

Key Findings

• Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code)
• Failure to comply with Article 82 of the French Data Protection Act: cookies read in spite of user consent withdrawal

Decision

For these two breaches, the restricted committee decided to impose a sanction on ORANGE, which is composed of:

• an administrative fine of 50 million euros, which was made public.
• an order to stop reading cookies after the withdrawal of consent by the person concerned, within three months, with a fine of 100,000 euros per day overdue.

For further information: 

• Closure of the injunction issued against ORANGE (English)
• National decision: Publicités insérées entre les courriels : sanction de 50 millions d’euros à l’encontre de la société ORANGE (French), Advertisements inserted among emails: ORANGE fined €50 million (English)