France’s data protection agency has fined Orange, a telecommunications company headquartered in Paris, the highest fine in the annals of French commerce.

The fine, amounting to 50 million euros, was levied by the Commission Nationale de l’Informatique et des Libertés (CNIL) on 14 November 2024.

Orange had sent advertisements indistinguishable from regular emails to its subscribers without their consent, violating the Communications Code and the Act on Data Processing, Data Files, and Individual Liberties.

In light of a ruling issued by the Court of Justice (ECJ) on 25 November 2021 (StWL Städtische Werke Lauf a.d. Pegnitz GmbH v eprimo GmbH), the CNIL determined that messages advertising services or products, which were not transmitted from one user to another but instead published in a space typically designated for private emails and resembling authentic emails, amounted to direct email marketing. As a result, securing the consent of the individuals involved was necessary.

The substantial fine was attributed to the company’s status as the leading telecommunications provider in France, the financial benefits it accrued, and the impact on approximately 7.8 million individuals.

The CNIL also ordered Orange to cease collecting cookies (tracking data) from users within three months of their withdrawal of consent, with a potential penalty of 100,000 euros for each day of non-compliance.

The fine constitutes 0.11% of Orange’s revenue, rendering it considerable compared to previous sanctions imposed by the CNIL. For example, the fine levied against Meta Ireland in 2021 for violating data protection laws amounted to 0.07% of the company’s revenue (in France). In 2023, the CNIL imposed a fine on Canal+ equivalent to 0.032% of its revenue.

In an official statement, the telecom company said it intends to appeal against the decision before the State Council (Conseil d’Etat). “Orange wishes to underline that the actions sanctioned do not involve a violation or breach of data security but reflect common market practices that do not engage any exploitation of customers’ personal data.”

“This sanction is all the more incomprehensible as Orange had not received any prior warning or peremptory notice on this matter,” it added, calling for “an immediate consultation between the competent authorities and all stakeholders in the digital sector to clarify, for the benefit of all, the interpretation of texts regarding commonly shared practices for which only Orange is sanctioned today.”

A company representative highlighted that customer data was never utilized without prior consent and noted that the advertisements were clearly marked as such, with changes made to the layout since then.