Orange S.A.
Headquartered in France, Orange provides mobile, landline, broadband, mobile financial services, and B2B services. With 340 million customers in 26 countries across Europe, Africa, and the Middle East, Orange is one of the largest mobile telecommunications companies in the world.
Orange achieved the greatest transparency gains among the 12 telcos evaluated by RDR. Although the company remained in 8th place, behind its European and U.S. peers, the gap between Orange and those companies narrowed significantly with its progress. It improved its transparency and accountability across advertising, user data management, and compliance practices which has increased its overall score. Orange also reaffirmed its commitment to net neutrality and enhanced security oversight through third-party security audits and ISO certifications.
In business, Orange expanded into the security sector, launching a new defence and homeland security division in June 2025 to provide connectivity, AI and cybersecurity services to European ministries and security operators. In October 2025, the company strengthened its European footprint by agreeing to acquire the remaining 50% stake in MasOrange for €4.25 billion, consolidating its position in the Spanish market.
This strategic expansion coincided with a series of cybersecurity incidents. In August 2025, Orange confirmed that data of some business customers had been stolen in a ransomware cyberattack. That same month, the company disclosed a separate breach affecting approximately 850,000 Belgian customers. Earlier in July 2025, Orange filed a formal complaint after detecting a cyberattack that disrupted services for business customers in France. The company only committed to notify affected users and relevant authorities “when Orange is legally or contractually required to do so.”
Orange also faced significant regulatory scrutiny. In late 2024 and January 2025, the French regulator fined Orange €50 million for inserting advertisements disguised as emails in its “ Mail Orange” service and for continuing to read cookies without valid user consent. In September 2025, France’s data protection authority closed the injunction after Orange corrected its unlawful cookie practices.
The 2026 RDR Index: Telco Giants Edition covers policies that were active on August 31, 2025. Policies that came into effect after August 31, 2025 were not evaluated for this ranking.
Scores reflect the average score across the services we evaluated, with each service weighted equally.
We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.
Orange maintained a strong position in the Governance category, ranking 4th among telecommunications companies evaluated, although it did not make any improvement in its governance disclosures this year. The company continued to articulate a clear commitment to freedom of expression and privacy (G1), supported by robust governance oversight of human rights issues (G2). It also provided considerable evidence of conducting comprehensive human rights impact assessments for government regulations, existing products and services, and new initiatives, with slightly less detail for the latter (G4a). Nonetheless, the company did not disclose whether it carried out similar assessments for its own policy enforcement (G4b), targeted advertising practices (G4c) or algorithmic systems (G4d).
Orange enhanced its policy disclosures in the freedom of expression category. The company published a brand new ad policy, specifying ad content banned on its platform and explained how targeted ads track users (F1b, F1c, F3b). However, the company failed to release any data around ads it prohibited (F4c), nor did it publish any data about the messages or phone calls blocked to enforce its own policies (F4a, F4b). Orange made a new net neutrality commitment (F9) and indicated that it may receive network shutdown orders from the authorities (F10). Nevertheless, the company’s transparency report did not include numbers of content or services blocked to comply with government demands (F6).
Despite some progress in this field, Orange continued to lag behind its European and U.S. peers in transparency around user privacy practices. It committed to minimizing user data collection this year (P3a); however, the company did not reveal whether or not it infers any user data (P3b). Orange specified data retention periods for various types of user data, but it did not commit to deleting all user information after users terminate their accounts (P6). Moreover, the company did not clarify whether users can fully opt out from its targeted ads or whether any user data is used to train its algorithmic systems (P7). While its transparency report provided some information about how it handles government demands for user information (P10a) and some data on the volume of such requests (P11a), the report still lacked key details. Orange received regular internal and external security auditing and established a vulnerability reporting center (P13, P14).