Closure of the injunction issued against ORANGE

Background

In November 2024, the restricted committee – the CNIL body responsible for issuing sanctions – had issued a fine of 50 million euros against ORANGE, as the investigations carried out had revealed that:

• on the one hand, the company displayed advertisements in the form of emails in the inboxes of users of its email service without obtaining the consent of the persons concerned, in violation of Article L. 34-5 of the French Postal and Electronic Communications Code,
   
• on the other hand, when users of the orange.fr website withdrew their consent to the placement and reading of cookies on their devices, the cookies previously placed continued to be read, in violation of Article 82 of the French Data Protection Act.

Although the company had already taken measures to remedy the first breach, the restricted committee issued, in addition to the fine, an order to cease reading the cookies after withdrawal of the consent of the individual concerned, within a period of three months.

Failure to comply with this injunction exposed the company to the payment of a penalty (i.e. an additional fine) of 100 000 euros per day of delay.

Closure of the injunction

In response to this injunction, the company provided evidence, within the specified time frame, demonstrating that once the user's consent was withdrawn, no further reading or writing operations by cookies took place on the website orange.fr.

Firstly, the company demonstrated that it took measures to remove - using a script - cookies linked to the domain ‘.orange.fr’ (first-party cookies) in the event of withdrawal of consent.

With regard to cookies placed by the company's partners (third-party cookies), ORANGE proved it took actions to prevent any reading or writing operations on its site once the user's consent had been withdrawn, by stopping new requests to third-party domains.  The CNIL nevertheless noted that these cookies were not removed from the browser. Indeed, as ORANGE did not have technical control over them, it could not delete them. Consequently, the user's browsing could continue to be tracked on third-party websites using the same cookie, thus revealing that it had, at some point, visited the website orange.fr. However the restricted committee considered that, given the current state of doctrine and case law from the French Council of State (Conseil d’État), these reading operations — carried out outside the website orange.fr — exceeded ORANGE’s responsibility. They fall under the responsibility of its partners, who should implement measures enabling ORANGE to inform them of the withdrawal of users' consent, so that they can draw any consequences. Furthermore, the restricted committee noted that ORANGE had justified contacting its partners to implement this type of measure.

In these circumstances, the restricted committee decided not to enforce the penalty payment (i.e. not to require payment of the additional fine referred to above) and to close the injunction.