France’s highest administrative court, the Conseil d’État, rejected Orange’s appeal on 16 October in decision n° 501268, so the Orange CNIL fine of €50 million stands. The line that matters most to analytics and consent teams is ¶12: reading cookies already on a device after the user withdraws consent is itself the breach, and the claim that the data underwent no further processing has no bearing on the breach. The same decision treats inbox ads that look like real emails as email direct marketing that needs prior consent.
Reading a cookie after withdrawal is the breach
The CNIL fined Orange for two breaches (¶1). The first was displaying ads that took the appearance of emails in the inboxes of Mail Orange users. The second, under art. 82 of France’s 1978 data-protection law, was the possibility of reading cookies on orange.fr visitors’ devices after they withdrew consent. In ¶12 the court found that the cookies were placed “without withdrawal of consent preventing those cookies from later being read by Orange or by its partners” (our translation). Then it dealt with Orange’s defence:
“Since the reading of this information stored on users’ devices is not disputed, the fact that it allegedly underwent no further processing has no bearing on establishing the breach of article 82 of the law of 6 January 1978.”
Conseil d’État, decision n° 501268, ¶12 (our translation)
Orange had argued that reading the cookies did not lead to later exploitation of the data. The CNIL’s 2024 release on the sanction had already said that art. 82 prohibits such reads even if the information is not used afterwards. The sanction itself, deliberation SAN-2024-019 of 14 November 2024, carried an injunction to stop reading cookies after withdrawal within three months, under a penalty of €100,000 per day of delay. In ¶16 the court upheld the CNIL’s reliance on the large number of people concerned, against Orange’s point about the low share of site visitors affected.
Does withdrawing consent require deleting cookies?
Neither source sets a deletion duty as such: the CNIL’s 2024 release asked for technical solutions that prevent reading, and its 2025 closure came even though third-party cookies stayed in the browser. The court’s decision describes no technical method, so the detail comes from the CNIL’s closure of the injunction. By decision SAN-2025-007 of 11 September 2025, announced on 18 September, the CNIL closed the injunction. Orange had shown that once consent was withdrawn, no further reading or writing operations by cookies took place on orange.fr. For first-party cookies it used a script to remove cookies linked to the “.orange.fr” domain. For third-party cookies it stopped new requests to third-party domains, but the CNIL noted those cookies were not removed from the browser, so browsing “could continue to be tracked on third-party websites using the same cookie”. Considering “the current state of doctrine and case law from the French Council of State”, the CNIL’s restricted committee held that reads outside orange.fr exceeded Orange’s responsibility. They fall to partners, who “should implement measures enabling ORANGE to inform them of the withdrawal of users’ consent”. The restricted committee decided not to enforce the penalty payment attached to the injunction and closed the injunction.
What else the court held
| Paragraph | Holding |
|---|---|
| ¶9 | Mail Orange users saw ads whose appearance was close to real emails, without validly obtained consent. The CNIL made no error of law. The contact-details condition was met because Orange “necessarily used” the email address to run them. |
| ¶12 | Reads of cookies after withdrawal are a breach, whether or not the data was processed further. |
| ¶5 | The Constitutional Council’s June 2026 ruling cannot be invoked against measures taken before its publication. |
| ¶14, ¶15 | The CNIL president need not justify skipping a warning, and a global fine need not be split by breach. |
| ¶16 | €50 million is 0.11% of worldwide annual turnover for the previous financial year and, given the gravity of the breaches and all the circumstances, not disproportionate. |
For the inbox ads, the court relied on the CJEU’s 25 November 2021 judgment in StWL (C-102/20): showing advertising in an inbox in a form resembling a real email is email direct marketing, allowed only with informed, specific consent (¶8). It added that the CNIL found the breaches more than twenty months after that ruling, so the rule was foreseeable (¶10). The decision does not rule on any other provider’s inbox ads, and we do not extend it to any.
The constitutional route had already been tried. In decision n° 2026-1210 QPC of 25 June 2026, the Constitutional Council held three paragraphs of art. L. 34-5, the provision behind the inbox-ads breach, unconstitutional because three authorities could punish the same facts with penalties of the same kind, which breaches the principle of necessity of penalties. It deferred abrogation to 31 October 2027 and ruled that decisions taken before its publication cannot be challenged on that ground. Orange’s argument therefore failed.
What analytics and consent teams should check
The ruling covers reads after withdrawal, not every cookie. It does not change the consent regime itself, which stays in place after the Council of the EU dropped Article 88b. The breaches rest on two French provisions, L. 34-5 and art. 82 (¶1). For the amount, the court quotes the GDPR’s Article 83(2) factors, which French law tells the CNIL to take into account (¶13), but it does not cite the EDPB’s guidelines on fines and reprimands, which are open for consultation until 13 November 2026.
- Test withdrawal as a user would: after withdrawing consent, does any script on your pages still read cookies set earlier? Reads count, not only new writes.
- Drop the argument that the data underwent no further processing. It did not help Orange in ¶12, and the CNIL says the same in its 2024 release.
- Look at what your consent tool does on withdrawal, because neither the court nor the CNIL credits any product feature. They describe an outcome: no reads or writes after withdrawal.
- Map your partner cookies and contact those partners. The CNIL’s 2024 release said Orange had to make sure its partners put similar solutions in place, and in the 2025 closure the restricted committee said partners should implement measures enabling Orange to inform them of a withdrawal, noting that Orange had shown it contacted its partners.
We found no public statement from Orange on the ruling in our search on 20 October.