The CNIL imposes a 50 million euro fine on Orange for unauthorized advertising

“The Internet service provider, and messaging provider Orange, used its messaging service to slip advertisements between emails,” which themselves took the appearance of emails, detailed Louis Dutheillet de Lamothe, general secretary. of the National Commission for Information Technology and Liberties (CNIL).

The privacy protection authority, also competent in matters of the use of personal data in advertising, considered in its decision that these advertising inserts were assimilated to “advertising prospecting by direct mailing”, due to the resemblance to real emails. An interpretation consistent with that of the Court of Justice of the European Union (CJEU).

At the same time, it deduced that this breach could be sanctioned in the same way as sending traditional advertising. Under these conditions, the CNIL imposed a fine of 50 million euros on Orange. A decision which should also act as a “warning” to other operators, underlined Louis Dutheillet de Lamothe.

A very high fine

The fine imposed on Orange reaches a high amount, and a level rarely reached by public sanctions, outside of convictions of technology giants. For comparison, Google was fined the same amount in 2019 for breaches of the data protection regulations (GDPR), and the total amount of fines imposed by the CNIL amounted in 2023 to 89 million ‘euros.

The decision with regard to Orange was taken in view of the number of users concerned: according to the CNIL, more than 7.8 million users have seen unwanted advertisements displayed in their mailbox. The supervisory authority also highlighted the existence of a “financial advantage”, which was not detailed, for the company.

The CNIL “took into account the fact that it was a breach which brought in money, which was valued”, explains Louis Dutheillet de Lamothe, referring to the marketing of these advertising banners to advertisers. However, the fine takes into account the changes made by Orange: since November 2023, its messaging service has modified the display of advertisements with a new format which “now makes it possible to clearly distinguish advertisements from real emails”, notes the Cnil.

Orange contests

“Orange takes note of the CNIL’s decision but contests the sanction and the totally disproportionate nature of its amount. Orange would like to point out that the alleged facts do not relate to a violation or a security defect but to standard market practices that do not involve any use of its customers’ personal data. This sanction is all the more incomprehensible as Orange was not the subject of any prior warning or formal notice on this subject,” specifies the company.

“This is why Orange intends to appeal against this decision before the Council of State. Without delay, Orange calls for consultation between the competent authorities and all digital players to clarify for the benefit of all the interpretation of the texts on commonly shared uses and for which only Orange is condemned today. continues the group.

In addition, the authority also reported a formal notice from the company regarding its management of third-party cookies via the messaging service. The CNIL discovered that cookies, these markers which allow companies to trace an Internet user’s journey on the web, were still sent to Orange’s messaging service even after users’ consent was withdrawn. A practice contrary to the Data Protection Act. “What the CNIL and the regulations require is that there is no longer any sending of information” via cookies once consent is deactivated, specified the secretary general of the CNIL. On this aspect, the company has three months to comply. Otherwise she will be penalized with a fine of 100,000 euros per day of delay.