Inbox advertising: Orange must pay 50 million euros data protection fine

The French telecommunications provider Orange is paying a comparatively high price for displaying advertising directly in the e-mail inbox. The French data protection authority CNIL has imposed a fine of 50 million euros on the network operator, mainly for this reason. The auditors had previously found that France's leading telecommunications provider was displaying advertising in a similar form in its users' inboxes alongside genuine emails. Based on a ruling by the European Court of Justice in 2021, the CNIL came to the conclusion that this direct customer approach in an area normally reserved for private e-mails would have required the consent of the person concerned under the French Post and Electronic Communications Act.

In its decision published on November 14, the supervisory authority stated that it took into account the fact that Orange has not used this type of advertising since November 2023 and that the newly implemented form makes it possible to clearly distinguish advertisements from genuine emails. The auditors also discovered another problem: if a user of the orange.fr website revoked their consent to the storage and reading of cookies on their devices, relevant browser files previously stored there continued to be read. The CNIL deemed this to be a violation of Article 82 of the French Data Protection Act.

Penalty in the event of a repeat offense

The fine covers both infringements. The CNIL also ordered Orange to stop reading cookies within three months of the withdrawal of consent and to take technical protective measures to prevent any recurrence. Otherwise, a fine of 100,000 euros per day could be imposed. In Germany, the Federal Court of Justice (BGH) ruled in 2022 that web-based email services such as T-Online, GMX, web.de or Gmail may not simply display advertising messages in the inbox of users of free basic versions. This practice, which is reminiscent of spam, therefore requires explicit informed consent in accordance with the General Data Protection Regulation (GDPR).

Relevant providers immediately adapted their declarations of consent. Since then, they have also included a clause for inbox advertising. Alternatively, there is the option to continue using free versions of the services with personalized classic banner ads.

"Users have a choice with the Web.de and GMX services," a company spokesperson explained to heise online. "They can decide in full knowledge of the facts how advertising banners are displayed. To this end, we show our users a dialog box in which they are clearly and precisely informed that advertising messages can either be displayed in the list of private emails received ('Inbox Ads') or displayed as large advertising banners instead."

(vbr)