Orange: withdrawal had to stop cookie access, not just update the banner

CNIL’s follow-up recounts two findings: advertisements presented among inbox emails without the required consent, and continued cookie reads on orange.fr after withdrawal. CNIL follow-up closing the injunction.

Orange subsequently demonstrated removal of relevant first-party cookies and prevention of further third-party read/write operations on its site by stopping new third-party requests. Authority notice on EDPB.

The recorded fine is EUR 50,000,000. On 11 September 2025 CNIL closed the cookie injunction and declined to enforce the conditional daily penalty. Closure of that injunction is not described here as cancellation of the original fine. CNIL follow-up closing the injunction.

These are implementation checks suggested by Inth, not additional findings about the company.

• Test after withdrawal, then navigate and reload; inspect requests as well as the stored preference.
• Review cleanup of first-party cookies and controls that prevent further requests to third-party domains.
• Document the boundary between controls on your own site and actions only the external cookie owner can take.

Website audit can record observable requests and consent state. Inth Consent gates optional integrations under the configured opt-in policy and records visitor choices.

Do not assume a banner deletes every third-party cookie or controls tracking on another website. Vendor configuration and withdrawal behaviour still need testing.

• CNIL follow-up closing the injunction
• Authority notice on EDPB

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.