In a decision that leaves a lasting impression, the CNIL unveiled this Tuesday its biggest sanction of the year against Orange. The French authority for the protection of personal data accuses the operator of having inserted advertisements disguised as emails within its messaging system, without having obtained the prior consent of users. A practice which constitutes a direct violation of the Post and Electronic Communications Code (CPCE).
A deceptive advertising strategy unmasked
The technique used by Orange was particularly insidious. The operator skillfully slipped advertising inserts between users’ real emails.
These ads were designed to look like real emails, deliberately confusing users. Louis Dutheillet de Lamothe, secretary general of the CNIL, underlined the seriousness of this practice which affected millions of users daily.
The CNIL did not hesitate to qualify this strategy as “advertising prospecting by direct mailing”thus aligning with the interpretation of the Court of Justice of the European Union. This legal qualification allowed the data protection authority to apply the sanctions provided for the sending of unsolicited advertisements.
An exemplary financial sanction
The amount of 50 million euros was not chosen at random. The CNIL took into account several aggravating factors in its calculation. The extent of the violation, reaching more than 7.8 million usersparticularly weighed in the balance.
The authority also considered the significant financial advantage that Orange derived from this practice, in particular through the marketing of advertising space to advertisers.
To put this fine into perspective, it represents more than half of the total amount of sanctions imposed by the CNIL in 2023, which amounted to 89 million euros. This decision places Orange on the same level as Google, which received a similar fine in 2019 for breaches of the GDPR.
The matter does not end there for Orange. The CNIL also discovered irregularities in the management of cookies by the operator. Even after the explicit withdrawal of users’ consent, Orange’s messaging service continued to send third-party cookies, these small files allowing the behavior of Internet users to be tracked.
Faced with this new offense, the authority gave Orange an ultimatum. The operator has three months to comply with the cookie regulations. After this deadline, a penalty of 100,000 euros per day of delay will be applied, considerable financial pressure to accelerate the necessary changes.
Orange has not remained inactive in the face of these accusations. Since November 2023, the operator has changed the display of advertisements in its messaging service. New format now allows users to clearly distinguish advertisements from real emails. A positive development that the CNIL took into account in its decision, but which was not enough to avoid the sanction.
This decision by the CNIL sends a strong message to the entire telecommunications sector. Louis Dutheillet de Lamothe also described it as “ warning » for other operators who might be tempted by similar practices.
- Orange fined 50 million euros for hiding advertisements in the mailboxes of 7.8 million users
- The operator must also correct its management of cookies under penalty of a penalty of 100,000 euros per day.
- A new, more transparent advertising format has been in place since November 2023, but has not avoided the sanction
