Orange, France's leading telecommunications operator, sold advertising space inside its Mail Orange email service. Advertisements were inserted among genuine incoming emails and designed to look like real messages. Users had not consented to receiving them. Over 7.8 million people saw the ads in their inboxes before Orange stopped the practice in November 2023.
Separately, on the orange.fr website, cookies continued to be read by Orange and its partners even after users had withdrawn their consent. The CNIL found that the act of reading stored data from a user's device is prohibited after consent withdrawal, regardless of whether the data is subsequently used.
On 14 November 2024, the CNIL's restricted committee fined Orange €50 million. It cited the scale of the audience (7.8 million), Orange's market position, and the financial advantage derived from the breach. Orange was ordered to stop reading cookies after consent withdrawal within three months, under penalty of €100,000 per day of non-compliance.
Orange was fined €50 million for slipping ads into 7.8 million inboxes and ignoring cookie consent, with a €100,000 per day penalty for non-compliance.
Orange treated its email users' private inbox space as an advertising inventory to be sold — the CRM relationship became the ad channel
The ads were designed to resemble genuine emails, exploiting the trust users place in their inbox rather than earning attention through a clearly labelled format
No consent mechanism existed for the inbox ads: users were not asked, and the format made opting out structurally impossible
The cookie violation showed the same pattern at the website level: consent withdrawal was recorded but not enforced, so tracking continued silently
A customer's inbox is not ad inventory. Controlling both the channel and the ads creates the temptation to monetise directly — consent exists because the channel is private.
Orange had already stopped the inbox ad format in November 2023, before the CNIL ruling. Its newer advertising display distinguishes ads from genuine emails. The case is cited in European data-protection discussions as the largest French fine for direct-marketing violations, and as a warning to any platform that controls both a communication channel and an advertising business.
FOLLOW THE EVIDENCE