The constitutional censure of the cumulative enforcement regime of Article L. 34-5 of the CPCE: analysis of the consequences of Decision no. 2026-1210 QPC of 25 June 2026 (Société Orange SA)

Handed down on a referral from the Conseil d’État (no. 501268 of 17 April 2026), in the context of Orange’s challenge to a EUR 50 million fine imposed on it by the CNIL, and in which Groupe Canal+ took part as a voluntary intervener, the decision calls for careful reading, both as to the partial dismantling of the text and as to the scope of its effects over time.

The layered construction of Article L. 34-5 CPCE

The censured provisions were not the product of a single design. They accreted over nearly twenty years, and the three paragraphs struck down correspond to three distinct moments in that history.

Article L. 34-5 was first created by the Law for confidence in the digital economy (Law no. 2004-575 of 21 June 2004), originally numbered L. 33-4-1 before being codified as Article L. 34-5 of the CPCE. From the outset, the text associated two authorities with its enforcement: the CNIL, an independent administrative authority responsible for monitoring compliance under the sixth paragraph, exercising the powers it derives from Law no. 78-17 of 6 January 1978, and the DGCCRF, under the seventh paragraph, which referred to that administration’s powers to investigate and establish breaches.

The consumer law known as the loi Hamon (Law no. 2014-344 of 17 March 2014) marked a decisive step: its Article 115 gave the DGCCRF its own power to impose an administrative fine, then capped at EUR 3,000 for an individual and EUR 15,000 for a legal entity (eighth paragraph of Article L. 34-5), and introduced a coordination rule. Where the DGCCRF has imposed a fine, ARCEP (Article L. 36-11), if it in turn imposes a penalty, must ensure that the aggregate amount of the penalties imposed on the same person for the same facts does not exceed the highest applicable statutory maximum (penultimate paragraph of Article L. 34-5).

This safeguard is telling. The legislature coordinated the DGCCRF and ARCEP, but it never included the CNIL in this aggregate cap.

Yet the CNIL’s powers had, in the meantime, changed scale. The Law for a Digital Republic (Law no. 2016-1321 of 7 October 2016) raised the ceiling of its fines from EUR 150,000 to EUR 3 million, and the GDPR, applicable since 25 May 2018, then set it at up to EUR 20 million or 4% of total worldwide annual turnover. The law on telephone canvassing, known as the loi Naegelen (Law no. 2020-901 of 24 July 2020), for its part merely raised the DGCCRF ceiling to EUR 75,000 and EUR 375,000 (Article 8).

At the end of these legislative strata, Article L. 34-5 could be enforced by three repressive authorities, only two of which were coordinated with each other; the third, the CNIL, which held the heaviest sanctions, remained outside any non-cumulation rule. It is this assemblage that the Constitutional Council censured.

The framework of the Orange SA and Canal+ cases

At least a dozen recent cases give the constitutional censure its concrete dimension. Two of them shaped the debate before the Constitutional Council.

The first is that of Orange, which gave rise to the QPC. By decision no. SAN-2024-019 of 14 November 2024, the CNIL’s restricted committee imposed on Orange a fine of EUR 50 million for displaying advertising messages between the emails of users of its Mail Orange service without first obtaining their consent, in breach of Article L. 34-5 of the CPCE and of Article 82 of the Law of 6 January 1978 on cookies. It was in support of its challenge to that CNIL sanction before the Conseil d’État that Orange raised the priority constitutionality question.

The second is that of Groupe Canal+, a voluntary intervener at the QPC stage. A publisher and distributor of audiovisual services, and therefore a non-telecom operator, Canal+ had been fined EUR 600,000 by the CNIL (decision no. SAN-2023-015 of 12 October 2023) for marketing operations whose validity of consent the CNIL disputed, the Commission applying Article L. 34-5 of the CPCE together with Article 7 of the GDPR. A challenge to that sanction before the Conseil d’État has given rise to two questions referred by the Conseil d’État to the Court of Justice of the European Union (no. 490202 of 5 May 2025).

These two situations illuminate the defect in the text. For an operator that is not an electronic communications operator, the real overlap is not between the CNIL and ARCEP but between the CNIL and the DGCCRF. And the clearest illustration of the artificial nature of the boundary between these regimes comes from the CNIL’s own practice, which penalises the same marketing conduct by combining Article L. 34-5, the GDPR’s definition of consent and Article 82 of the Law of 6 January 1978, where the insertion of a marketing email into an electronic mailbox results from the use of cookies, themselves subject to a consent-and-exemption regime under Article 5(3) of the ePrivacy Directive 2002/58.

The penalties at stake

The financial stakes are not theoretical. For identically characterised facts, exposure ranged from the modest to the disproportionate depending on which authority acted. The DGCCRF could not exceed EUR 375,000 for a legal entity. ARCEP could impose a penalty of up to 3% of net turnover, raised to 5% in the event of a fresh breach. The CNIL, for its part, could reach EUR 10 million or 2% of worldwide turnover, those ceilings being raised, in certain cases, to EUR 20 million or 4% of that turnover. The EUR 50 million fine imposed on Orange, set against the DGCCRF’s EUR 375,000 ceiling, measures the scale of the gap.

This exposure was nothing exceptional. On the basis of Article L. 34-5, the CNIL has built a substantial enforcement practice (notably decisions no. SAN-2022-011, SAN-2022-017 and SAN-2022-021, then SAN-2023-015, SAN-2024-002, SAN-2024-014, SAN-2024-015, SAN-2025-001 and SAN-2025-002), and had stated in its observations that, beyond the Orange case, five further challenges to sanctions based on this text were pending.

A censure based on the identity of the protected interests

The Constitutional Council applied its settled analytical framework. The principle of necessity of offences and penalties prohibits a single person from being subject to several sets of proceedings seeking to penalise the same facts, characterised in the same way, by penalties of the same nature, in order to protect the same social interests; the principle of proportionality further requires that the aggregate amount of any penalties imposed not exceed the highest of the maxima incurred.

The three conditions were met. First, the three authorities penalise the same breach of Article L. 34-5, and thus facts characterised in the same way, since they derive from a single provision. Second, and this is the heart of the decision, the various enforcement regimes are intended to ensure “the protection of the privacy of users of electronic communications services against unsolicited commercial marketing”, so that “these three forms of enforcement therefore protect the same social interests”. Third, the nature of these administrative penalties is no different, whether the fine of the CNIL, that of ARCEP or that of the DGCCRF. It follows that the provisions of Article L. 34-5 infringe the principle of necessity of penalties, without there being any need to examine the ground based on equality before the law.

The Council’s reasoning aligns with the position argued by the applicant and the intervener. The Prime Minister himself, in deferring to the wisdom of the Council, had lent it credence by acknowledging that the proceedings at issue had, regardless of the authority bringing them, a common object. The CNIL’s defence, founded entirely on the idea of distinct interests, was not upheld. The precise scope of the censure should be stressed: the prohibition on marketing without consent, set out in the opening paragraphs of the article, remains; only the three paragraphs that organised the cumulation of enforcement are struck down.

In particular, the censure preserves only the DGCCRF’s investigatory powers under the seventh paragraph of Article L. 34-5, which serve to establish breaches but do not confer the power to impose a fine. The DGCCRF’s own sanctioning power, set out in the eighth paragraph, is among the provisions censured.

On the effects over time

It is on this terrain that the decision is at once most instructive and most complex.

The Council refused immediate repeal, which would have prevented any proceedings and brought to an end those pending before the three authorities, consequences it found manifestly excessive. It therefore deferred the repeal to 31 October 2027, leaving the legislature time to rebuild a compliant enforcement regime.

In the meantime, and in order to bring the unconstitutionality to an end as from publication of the decision, the Council laid down a transitional reservation: no proceedings may be brought or continued on the basis of Article L. 34-5 by one of the three authorities once proceedings have already been brought, for the same facts and against the same person, before another of them, or where that person has already been definitively penalised. The risk of cumulative penalties is thus neutralised going forward, while the prohibition itself does not, during the deferral period, lose its sanction.

The most notable point concerns the fate of decisions already taken before 25 June 2026. The Council held that “decisions taken before publication of the present decision cannot be challenged on the basis of this unconstitutionality”. Earlier sanctions, notably the EUR 50 million fine imposed on Orange, are therefore shielded from this declaration of unconstitutionality. The applicant obtains the censure of the regime, but not the annulment of its own sanction on this ground. The same is true of the sanction imposed on Canal+ and of the five other pending challenges reported by the CNIL. The immediate practical effect of the decision is thus directed at the future, not at calling the past into question.

A limit on the stacking of administrative enforcement bodies

Beyond Article L. 34-5 alone, the decision sets a limit on the accumulation of repressive authorities in the digital field. What had been juxtaposed and cumulated must henceforth become exclusive and singular. The necessity of penalties, giving effect to a ne bis in idem logic, now applies. In practical terms, for investigations and proceedings under way on 25 June 2026 or initiated thereafter, the regulator that brings proceedings first will bar the other two from also imposing a penalty for the same facts.

The end of cumulation leaves a stark inequality before the law

In seeking to neutralise the declared unconstitutionality with surgical precision, the Council has left in place a lottery of the unlucky. During the deferral period, the three sanctioning regimes remain in force, but the transitional reservation means that the first authority to bring proceedings for given facts forecloses the others. Because the ceilings differ so widely, exposure for identical facts depends on which regulator moves first. If the DGCCRF leads an investigation begun before 25 June 2026, or opens a new one, the targeted undertaking will face only the DGCCRF’s ceilings. If, on the other hand, the CNIL has initiated a control, the penalty incurred may be hundreds of times higher than those the DGCCRF, or ARCEP, could have imposed, for the same facts.

Ultimately, the penalty incurred will be the first one imposed among the three possible, until 31 October 2027 at the latest. This is apt to foster a corrosive competition between regulators and to feed a breach of equality before the law, flowing from an arbitrary lottery according to which regulator prosecutes first.

An inequality that it now falls to the legislature to correct

France has until 31 October 2027 to repeal and then properly rewrite the enforcement regime of Article L. 34-5 of the CPCE.

By preserving the DGCCRF’s investigatory powers under the seventh paragraph, the Council ensured the continuity of that authority’s powers to investigate and establish breaches. Its power to impose fines, however, set out in the censured eighth paragraph, will lapse on 31 October 2027 absent new legislation, as will those of the CNIL and ARCEP.

The Council has not, however, purged the inequality before the law, which over the coming months will depend on an inherently arbitrary contingency: as matters stand, the identity of the regulator that sanctions first determines the penalty incurred. Its ceiling will be set not by statute but by an unforeseeable and unequal temporal circumstance which, at bottom, is just as open to constitutional criticism as the cumulation regime that has just been struck down.

It now falls to the legislature to repeal without delay the provisions of Article L. 34-5 declared unconstitutional and to bring an end to this lottery of the unlucky, by adopting before 31 October 2027 a new enforcement regime of its choosing.

Authored by Etienne Drouard, Anaïs Ligot, and Rémy Schlich.