Conseil d’État Upholds Orange’s €50 Million Fine for Ads in the Inbox

France's highest administrative court has confirmed the €50 million fine imposed on Orange for showing advertisements inside the inbox of its webmail. In a decision dated 16 October 2026, the Conseil d'État rejected Orange's appeal in full and agreed with the regulator on the key point: an advert displayed among a user's emails, in the space reserved for private messages, is direct marketing by email and needs prior consent.

The ruling closes the main French case on "native" inbox advertising. It also gives every mailbox provider, webmail operator and ad network a clear reference: in France, the format of an ad does not change the rule if it sits in the inbox list and looks like a message.

What the CNIL sanctioned in 2024

The CNIL found that Mail Orange displayed advertisements between the emails of its users, formatted to look like messages in the inbox list. It treated them as direct marketing by electronic mail under article L.34-5 of the French Postal and Electronic Communications Code, which requires the recipient's prior consent. To reach that conclusion, the CNIL relied on the 2021 ruling of the Court of Justice of the European Union in case C-102/20, StWL v eprimo, which already classed inbox ads of this kind as electronic mail for direct marketing.

The CNIL held Orange responsible because it chose to display these ads and sold the advertising space. Orange stopped the practice in November 2023. The second breach concerned cookies: on orange.fr, cookies already stored on a device kept being read after the user withdrew consent, which the CNIL found contrary to article 82 of the French Data Protection Act, even if the information was not used afterwards.

The 2024 sanction also included an order to stop reading cookies after a withdrawal of consent, backed by a daily penalty. The CNIL closed that order in September 2025 without collecting the penalty.

What the Conseil d'État decided

Orange challenged both breaches and the amount. The court rejected every argument:

• Inbox ads are email marketing. Showing ads in the inbox "s'apparente à l'utilisation de courrier électronique à des fins de prospection directe", so prior consent was required, and Orange necessarily used the email address to display them.
• The rule was foreseeable. The breaches were found more than 20 months after the CJEU ruling, so Orange could not argue that the interpretation was new.
• Reading a cookie is enough. Accessing a cookie after a withdrawal of consent is a breach even without any later processing.
• No warning was needed. The CNIL did not have to issue a formal notice before sanctioning.
• The amount stands. The single fine did not have to be split between the two breaches, and 0.11% of worldwide turnover is not disproportionate.

The constitutional detour

In April 2026, the court had referred a constitutional question raised by Orange on article L.34-5. On 25 June 2026, the Conseil constitutionnel (decision no. 2026-1210 QPC) struck down the provisions that let the CNIL, the DGCCRF and ARCEP all sanction the same facts, but deferred the repeal to 31 October 2027 and ruled that earlier measures could not be challenged on that ground. The Conseil d'État therefore dismissed Orange's argument based on that decision. The consent rule itself was not affected.

Action checklist

• Treat inbox ad placements as email marketing: if you buy native ads inside webmail inboxes for French users, ask the provider how it collects prior consent.
• Document consent for every channel that reaches an inbox, including sponsored messages and partner placements, not only your own campaigns.
• Stop reading cookies after a withdrawal: test that your consent tool blocks access to cookies already stored, not only new ones.
• Review your CMP logs for the time between a refusal and the moment tags stop firing.
• Do not count on a warning: the court confirmed the CNIL can sanction without a formal notice first.

Why this case matters beyond Orange

Until now, the qualification of inbox ads as email marketing rested on the CJEU ruling and on the CNIL's own reading of it. With the Orange decision upheld by the Conseil d'État, that analysis has been tested before a French court, and any operator that monetises the inbox can expect it to be applied again. For French consent rules in email marketing, our guide on GDPR for email marketing covers consent, legitimate interest and B2B prospecting, and our profile of the CNIL explains how the regulator works.

Sources

1. Conseil d'État, decision no. 501268 of 16 October 2026 (primary source, French)
2. CNIL: sanction of €50 million against Orange, 10 December 2024 (French)
3. Conseil d'État, decision no. 501268 of 17 April 2026 (referral to the Conseil constitutionnel)
4. CNIL: closure of the order against Orange, September 2025 (French)
5. Court of Justice of the European Union (case C-102/20, StWL v eprimo, 25 November 2021)

Related on SMTPedia

• CNIL, France's data protection authority: what you need to know
• GDPR for email marketing: consent, legitimate interest and cold B2B email
• The largest email marketing fines on record