ORANGE SA

What the regulator decided

Orange displayed commercial advertisements between users' email messages in its webmail interface, a form of electronic prospecting requiring prior consent under Article L. 34-5 CPCE that Orange did not obtain; and continued to read information stored on users' terminals through cookies after the user had withdrawn consent, in breach of Article 82 of the French Data Protection Act.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Anchors two distinct principles in one decision: ad units in a webmail inbox are prospecting under Article L. 34-5; and a consent-withdrawal signal must stop downstream reads as well as future writes. The consent-withdrawal limb is the more novel of the two, because it reaches the post-CMP-update flow.