7.8 million users affected: Orange sanctioned for its advertisements disguised as emails

© Orange

In a decision that will make an impression, the CNIL unveiled its most significant sanction of the year against Orange on Tuesday. The French data protection authority accuses the operator of having inserted advertisements disguised as emails in its messaging system, without having obtained users' prior consent. A practice that constitutes a direct violation of the Postal and Electronic Communications Code (CPCE).

A misleading advertising strategy unmasked

The technique used by Orange was particularly insidious. The operator skillfully slipped advertising inserts between users' real emails.

These advertisements were designed to look like real emails, deliberately confusing users. Louis Dutheillet de Lamothe, Secretary General of the CNIL, highlighted the seriousness of this practice, which affected millions of users daily.

The CNIL did not hesitate to describe this strategy as ” advertising prospecting by direct mail “, thus aligning itself with the interpretation of the Court of Justice of the European Union. This legal qualification allowed the data protection authority to apply the sanctions provided for the sending of unsolicited advertising.

An exemplary financial penalty

The amount of 50 million euros was not chosen at random. The CNIL took into account several aggravating factors in its calculation. The scale of the violation, affecting more than 7.8 million users, weighed particularly heavily in the balance.

The authority also considered the significant financial advantage that Orange derived from this practice, in particular through the marketing of advertising space to advertisers.

200% Deposit Bonus up to €3,000 180% First Deposit Bonus up to $20,000

To put this fine into perspective, it represents more than half of the total amount of sanctions imposed by the CNIL in 2023, which amounted to 89 million euros. This decision places Orange on the same level as Google, which was similarly fined in 2019 for GDPR violations.

Persistent problems with cookies

The case does not end there for Orange. The CNIL also discovered irregularities in the operator's management of cookies. Even after users explicitly withdrew their consent, Orange's messaging service continued to send third-party cookies, small files that can track the behavior of Internet users.

Faced with this new violation, the authority has set an ultimatum to Orange. The operator has three months to comply with the cookie regulations. After this deadline, a penalty of 100,000 euros per day of delay will be applied, a considerable financial pressure to accelerate the necessary changes.

Orange has not remained inactive in the face of these accusations. Since November 2023, the operator has changed the display of advertisements in its messaging service. The new format now allows users to clearly distinguish advertisements from real emails. A positive development that the CNIL took into account in its decision, but which was not enough to avoid the sanction.

This decision by the CNIL sends a strong message to the entire telecommunications sector. Louis Dutheillet de Lamothe also described it as a ” warning ” for other operators who might be tempted by similar practices.

• Orange fined €50 million for hiding ads in the inboxes of 7.8 million users
• The operator must also correct its cookie management or face a penalty of €100,000 per day
• A new, more transparent advertising format has been in place since November 2023, but has not avoided the penalty

📍 To not miss any Presse-citron news, follow us on Google News and WhatsApp.

[ ]