Fifty million euros for Orange. Three hundred and twenty-five million for Google.
Two decisions, two operators, one shared reasoning. And a consequence the market has not yet measured: advertising displayed inside an inbox is direct marketing by electronic mail, with everything that implies.
The reasoning, in one sentence
The French authority sanctioned Orange on 14 November 2024, over advertisements inserted between emails in its webmail. The press release sets out the legal qualification:
“La CNIL, s’appuyant sur un arrêt de la Cour de justice de l’Union européenne (CJUE) du 25 novembre 2021, a considéré que ces messages faisant la promotion de services ou de biens et qui ne sont pas envoyés par un utilisateur à un autre utilisateur, mais affichés dans un espace normalement réservé aux courriels privés en prenant l’apparence de véritables courriels, constituent de la prospection directe par courrier électronique.”
Three elements ground the qualification. Promotional content. Placement, in a space reserved for private mail. And appearance, that of a genuine email.
None of those elements requires that a message actually travelled through an SMTP server. What counts is the place and the resemblance.
The consequence is immediate: consent must be obtained under Article L. 34-5 of the French postal and electronic communications code.
The same analysis, applied to Google
On 1 September 2025 the authority fined Google LLC and Google Ireland Limited 325 million euros, for facts of the same nature in Gmail, alongside breaches concerning trackers.
The reasoning is identical, and this time it covers the Promotions tab and the inbox advertising slots.
The decision also contains a jurisdictional point that explains why these cases escape the usual mechanisms:
“Le mécanisme de coopération prévu par le RGPD (mécanisme de ‘guichet unique’) n’a pas vocation à s’appliquer dans ces procédures dans la mesure où les opérations liées à l’utilisation des traceurs et à la prospection électronique relèvent non pas du RGPD mais d’autres règles (la directive ‘ePrivacy’).”
In other words: the French authority can sanction a company established in Ireland directly, without going through the Irish authority, because the legal basis is not the GDPR but the ePrivacy directive.
That is a technical point, and it is the one that makes sanctions at this level possible.
What this says about the text itself
Article L. 34-5 prohibits direct marketing by electronic mail without prior consent. It dates from a time when electronic mail meant a message sent from one server to another.
The Court of Justice, then the French authority, have given it a functional reach: what takes the appearance of an email, in the space of an email, follows the regime of an email.
That reading has had a constitutional sequel. Orange challenged the enforcement arrangements, and the Constitutional Council struck down the cumulation of sanctions without touching the prohibition itself.
The prohibition holds. It is the organisation of proceedings that was revised.
Who is concerned, beyond the two operators
It would be comfortable to file these decisions under matters for giants. That would miss the rule.
The test adopted depends neither on the size of the player nor on the technology used. It depends on three things: promotional content, a space reserved for private correspondence, and the appearance of a personal message.
Any interface combining those three elements falls within scope. An in-app message centre inserting an offer between two notifications. A customer account whose message box hosts promotions presented as messages. A product displaying an advertisement formatted as an email inside a list of emails.
The question to ask is not “is this an email”. It is: “does this look like a personal message, in a place where personal messages are expected”.
The connection to your campaigns
These two decisions change nothing about what you must do when you send a newsletter. The regime was already prior consent in B2C, and framed legitimate interest in B2B.
They change something about what you can buy.
If you buy an advertising slot displayed inside an operator’s inbox, you are buying direct marketing by electronic mail. The applicable regime is that of Article L. 34-5, not that of online display advertising.
The question to put to the ad network therefore becomes: on what consent does the delivery of this format rest? That is exactly the question the authority put to Orange, and then to Google.
What to do tomorrow morning
Inventory the advertising formats you buy, and isolate those that display inside a mail interface. They are the only ones these decisions concern, and they carry a different risk from the rest.
If you publish a product with an internal message centre, look at what you insert into it. An offer presented as a message, in a list of messages, has been qualified by the authority with two precedents behind it.
And if you are tempted to reproduce that format because “it is not a real email”, remember the phrase: “en prenant l’apparence de véritables courriels”. It is precisely the appearance that triggers the qualification, not the technology.
Sources
- CNIL (14 November 2024). Publicités insérées entre les courriels : sanction de 50 millions d’euros à l’encontre d’ORANGE, decision SAN-2024-019
- CNIL (1 September 2025). Publicités insérées entre les courriels et cookies : la CNIL sanctionne GOOGLE d’une amende de 325 millions d’euros, decision SAN-2025-004
- European Union (12 July 2002). Directive 2002/58/EC (ePrivacy), Article 13
- CNIL (updated 10 June 2026). La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.