On November 14, 2024, the French Data Protection Authority (CNIL) fined the French telecommunications operator ORANGE 50 million euros, notably for displaying advertisements between the e-mails of users of its email service without their consent.
ORANGE provides its customers with an electronic messaging service ("Mail Orange"). Following several investigations, the CNIL found that the company was displaying advertisements in the form of emails among genuine emails in its users' inboxes.
On the basis of these findings, the restricted committee – the CNIL body responsible for issuing sanctions – considered that the display of such advertisements required the consent of ORANGE messaging service users, pursuant to Article L. 34-5 of the French Post and Electronic Communications Code (CPCE).
The CNIL's investigations also revealed that, when users of the orange.fr website withdrew their consent to the storage and reading of cookies on their devices, previously stored cookies continued to be read, in violation of Article 82 of the French Data Protection Act.