The encyclopedia · Advertising & PR · Marketing decision · 2023–2024
Orange slipped ads into 7.8M email inboxes disguised as real mail — fined €50M
France's top telecom sold ad slots inside its own email service. The ads looked like real mail. Users never consented. 7.8 million saw them.
Orange · 2024-11
What happened
Orange, France's leading telecommunications operator, sold advertising space inside its Mail Orange email service. Advertisements were inserted among genuine incoming emails and designed to look like real messages. Users had not consented to receiving them. Over 7.8 million people saw the ads in their inboxes before Orange stopped the practice in November 2023.
Separately, on the orange.fr website, cookies continued to be read by Orange and its partners even after users had withdrawn their consent. The CNIL found that the act of reading stored data from a user's device is prohibited after consent withdrawal, regardless of whether the data is subsequently used.
On 14 November 2024, the CNIL's restricted committee fined Orange €50 million. It cited the scale of the audience (7.8 million), Orange's market position, and the financial advantage derived from the breach. Orange was ordered to stop reading cookies after consent withdrawal within three months, under penalty of €100,000 per day of non-compliance.
Why it happened
- Orange treated its email users' private inbox space as an advertising inventory to be sold — the CRM relationship became the ad channel
- The ads were designed to resemble genuine emails, exploiting the trust users place in their inbox rather than earning attention through a clearly labelled format
- No consent mechanism existed for the inbox ads: users were not asked, and the format made opting out structurally impossible
- The cookie violation showed the same pattern at the website level: consent withdrawal was recorded but not enforced, so tracking continued silently
The lesson
A customer's inbox is not ad inventory. Controlling both the channel and the ads creates the temptation to monetise directly — consent exists because the channel is private.
Aftermath
Orange had already stopped the inbox ad format in November 2023, before the CNIL ruling. Its newer advertising display distinguishes ads from genuine emails. The case is cited in European data-protection discussions as the largest French fine for direct-marketing violations, and as a warning to any platform that controls both a communication channel and an advertising business.
Sources
- CNIL — Advertisements inserted among emails: Orange fined €50 million
- Reed Smith — Direct marketing and profiling: recent fines
- GRC Report — Orange fined €50 million for slipping ads into user emails without consent
spotted an error? The club wants to know.
More like this
SFR sold plans 'guaranteed for life' — then raised the prices. €10M fine
Free held 24 million customers' bank details too long. A breach cost it €42M.
Vodafone's 'The Nation's Network' claim kept getting banned
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.