Orange – €50,000,000 Fine (France, 2024)

Among other services, the respondent provides an e-mail service called “Mail Orange” to more than 7,800,000 users and is the leading telecommunications operator in France. In an ex-officio investigation, the French Data Protection Commission (Commission Nationale de l’Informatique et des Libertés – CNIL) found the following: Between the 7 and 12 June 2023, users were confronted with advertisements which were displayed like regular e-mails in their inboxes. The only recorded difference to regular emails was that the advertisements appeared in a light grey colour, included the word “publicité” and a cross to delete the email instantly. In addition, it was found that the respondent operated cookies on user devices if they had agreed to this. The respondent's argument The respondent argued that the CNIL up until now has always placed the responsibility of obtaining data subject’s consent to advertising on the advertiser. It therefore, did not see itself responsible for obtaining consent as it merely transferred the email of the advertiser to the data subject, just like regular emails. It further explained that it used a system which allowed it to disseminate the advertising emails without processing the data subject’s email address. Operation of cookies When users withdrew their consent to the placement of cookies on their device, the cookies which had previously been activated continued to function. Here the respondent argued that the data collected through the cookies after consent had been withdrawn was not then further processed by the respondent. Requirement of consent The CNIL based its decision on the CJEU judgment C-102/20 which showed that e-mails which are displayed in a space normally used for private e-mails containing promotional content, constitute direct marketing which in turn requires the data subject’s consent. Therefore, the CNIL concluded that in this case as per [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000042155961/ Article L.