Why the French CNIL fine against Orange for email ads is a misstep

The new French fine against Orange for notably displaying ads among a list of e-mails is a misstep, in my view. It builds upon a rare legal misstep of the CJEU, a case in which the highest EU judges introduced subjectivity in an ePrivacy provision that was built around objective criteria.

I am speaking about the StWL v eprimo judgment of November 2021, regarding which I wrote a newsletter at the time at a previous firm – link: https://lnkd.in/er-EQwPk

In the judgment, the CJEU had indicated that the anti-spam rule – Art. 13 of the ePrivacy Directive, which prohibits the sending of unsolicited commercial communications without consent – prohibits the displaying of ads (personalised or not) within a list of e-mails because this gives the *impression* that they are sent by e-mail. Read my piece linked to above – it contains a look at the CJEU’s reasoning and the flaws of that approach and broader consequences.

As I wrote at the time:
***
“[W]e find the CJEU’s judgment very unfortunate, as it appears to have glossed over the actual purpose of the legislation and looked only at the�impression�given to the user, not the underlying�means�used for presenting an ad. This leaves a sour taste of subjectivity where we would have expected an objective approach.

“It raises important questions for the commercial viability of ad-supported communication services. When does an ad “prevent access” to messages? When does an ad seem to be “in the inbox”, and how big is the risk of a court going beyond the idea of an inbox? Will advertisers pay to show ads on such services, knowing that a court might grant a cease-and-desist order after just three displays of a same ad?

“A conclusion-driven judgment is never good for legal certainty, and we fear that the CJEU’s approach here could set a dangerous precedent for the world of online advertising. At least, that is what this�looks�like � perhaps the next online advertising case will show what the relevant means of legal reasoning should be.
***

I stand by that position still today. By applying this reasoning to Orange, the CNIL can obviously hide behind the CJEU – but it’s basically saying that the *appearance* of spam is sufficient for something to be spam. And that is a very bad legal development in my view.

Link to the CNIL’s decision of 14 November 2024 (published 10 December): https://lnkd.in/edisprvC
Link to the CJEU’s judgment of 25 November 2021: https://lnkd.in/ehhmqWwH

GDPR data protection