France’s leading telecommunications operator Orange has been fined €50m ($52.5m) by CNIL for displaying advertisements placed between e-mails without the consent of the recipient users. CNIL, the French Data Protection Authority, declared this to be a breach of Article L. 34-5 of the French Post and Electronic Communications Code.
The advertisements were displayed in the company’s own electronic messaging service and reached over 7.8 million people.
The company had also retained and read cookies that collected information on users of its website orange.fr even though these users had withdrawn their consent (after initially accepting such tracking cookies) – a violation of Article 82 of the French Data Protection Act.
“The amount of this fine was decided on the basis of the very high number of people concerned, as well as the company’s market position as France’s leading telecommunications operator,” the authority said.
No consent
CNIL started its investigation into Orange after receiving complaints from users who had not consented to the advertisements that they were receiving in their inboxes. The advertisements included those that promoted services or goods of other companies. Orange earned revenue from such advert placements.
The authority said that the advertisement messages were posted in a space “normally reserved for private emails and which looked like genuine e-mails” and that this constituted direct prospecting.
The regulator did take into consideration the fact that the company has ceased this type of actvity in November 2023 when handing down the decision. Another mitigating factor, according to CNIL, was that the way the advertisments have since been displayed makes it possible to easily distinguish between ads and genuine emails.
“The amount of this fine was decided on the basis of the very high number of people concerned, as well as the company’s market position as France’s leading telecommunications operator.”
CNIL
In addition to the €50m fine the company has been ordered to halt its use of cookies following the withdrawal of consent by users within three months. If it does not comply with this requirement it will face an additional €100,000 ($104,930) penalty a day for as long as the issue persists.