Free Mobile fined €27M by the CNIL after a 24M-contract breach
€27M
≈ $31.3M at the time
CNIL
France · 2026
Status: Not yet final
What happened
The CNIL found that Free Mobile's security was inadequate for the volume and sensitivity of its data, with weak authentication on the VPN used for remote work and ineffective detection of abnormal activity, after an attacker reached its systems in October 2024. It also found that the breach notice sent to subscribers lacked required information, and that Free Mobile kept millions of former subscribers' records for an excessive period.
Free Mobile must complete new security measures within three months and purge the records of customers whose contracts ended more than 10 years ago within six months. The companion decision against Free (SAN-2026-002, €15M) brings the combined penalty to €42M.
How it affected users
Data on about 24 million subscriber contracts across Free Mobile and Free was accessed, including IBANs of people who were customers of both. The CNIL received more than 2,500 complaints.
Status timeline
Jan 8, 2026
The CNIL's restricted committee adopted deliberation SAN-2026-001: a €27M fine for breaching Articles 5(1)(e), 32 and 34 GDPR, with orders backed by a €50,000 daily penalty for delay.
Jan 14, 2026
Decision published. Free announced that it had taken the case to the Conseil d'État.
Sources
- CNIL: Violation de données, sanction de 42 millions d'euros à l'encontre des sociétés FREE MOBILE et FREEregulator
- Légifrance: Délibération de la formation restreinte n° SAN-2026-001 du 8 janvier 2026 (FREE MOBILE)regulator
- Le Club des Juristes: La CNIL inflige une amende de 42 millions d'euros à Freenews
Last verified 2026-10-29. Spotted an error? Report a correction.
Cite this entry
Deepak Gupta, "Free Mobile fined €27M by the CNIL after a 24M-contract breach," Tech Fines Directory, guptadeepak.com, 2026-01-14. https://guptadeepak.com/tech-fines/violation/free-mobile-france-cnil-2026/