[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnqFJeYX2_Dh7OCoYF8wos3aM6fbVZOytDW3_u_F3rUM":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":23,"category":24,"article_tags":28},"e6a627b2-0bf7-4d1f-ae4b-133598b1c2c1","CE - No. 492836","ce-no-492836-8a10c2","Created page with \"{{COURTdecisionBOX |Jurisdiction=France |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=CE |Court_Original_Name=Conseil d'Etat |Court_English_Name=Supreme Administrative Court |Court_With_Country=CE (France) |Case_Number_Name=No. 492836 |ECLI=ECLI:FR:CECHR:2026:492836.20260520 |Original_Source_Name_1=Conseil d'État |Original_Source_Link_1=https:\u002F\u002Fwww.conseil-etat.fr\u002Ffr\u002Farianeweb\u002FCE\u002Fdecision\u002F2026-05-20\u002F492836 |Original_Source_Language_1=French |Origina...\" New page {{COURTdecisionBOX |Jurisdiction=France |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=CE |Court_Original_Name=Conseil d'Etat |Court_English_Name=Supreme Administrative Court |Court_With_Country=CE (France) |Case_Number_Name=No. 492836 |ECLI=ECLI:FR:CECHR:2026:492836.20260520 |Original_Source_Name_1=Conseil d'État |Original_Source_Link_1=https:\u002F\u002Fwww.conseil-etat.fr\u002Ffr\u002Farianeweb\u002FCE\u002Fdecision\u002F2026-05-20\u002F492836 |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Date_Decided=20.05.2026 |Date_Published= |Year=2026 |GDPR_Article_1=Article 4(11) GDPR |GDPR_Article_Link_1=Article 4 GDPR#11 |GDPR_Article_2=Article 6 GDPR |GDPR_Article_Link_2=Article 6 GDPR |GDPR_Article_3=Article 7 GDPR |GDPR_Article_Link_3=Article 7 GDPR |GDPR_Article_4=Article 30 GDPR |GDPR_Article_Link_4=Article 30 GDPR |GDPR_Article_5= |GDPR_Article_Link_5= |GDPR_Article_6= |GDPR_Article_Link_6= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Tagadamedia |Party_Link_1=https:\u002F\u002Fwww.tagadamedia.com\u002Ffr\u002F |Party_Name_2=CNIL |Party_Link_2=https:\u002F\u002Fwww.cnil.fr\u002Fen |Party_Name_3= |Party_Link_3= |Party_Name_4= |Party_Link_4= |Appeal_From_Body=CNIL |Appeal_From_Case_Number_Name=SAN-2023-025 |Appeal_From_Status= |Appeal_From_Link= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=bms | }} The Court reduced a CNIL fine against a lead generation company from €75,000 to €50,000 but upheld that its consent forms did not validly collect GDPR consent. == English Summary == === Facts === Tagadamedia, the controller, organised online competitions on websites it managed. In this context, it collected participants’ personal data, including names, postal addresses, email addresses and telephone numbers. It then transferred this data to commercial partners for marketing purposes in exchange for payment. The DPA, carried out an on-site inspection at the controller’s premises and later initiated sanction proceedings. The DPA found that the controller’s consent mechanisms did not allow users to give free, specific, informed and unambiguous consent to the transfer of their data to partners for marketing purposes. The controller had used different versions of consent forms. One version displayed a prominent “I agree” button, while the option to continue without receiving partner offers was only available through a less visible link in smaller text. Another version included two buttons, “I agree” and “I decline”, but the visual presentation continued to emphasise consent. The controller later proposed a new form with two similar buttons, “I agree” and “Next step”. The DPA imposed a €75,000 administrative fine for breaches of GDPR Articles 6 and 30. It also ordered the controller, under a daily penalty of €1,000, to implement a compliant form collecting valid consent for the transfer of data to partners. The controller appealed the decision before the Court. === Holding === The Court partly upheld the appeal. First, the Court rejected the controller’s procedural arguments regarding the DPA’s inspection and the referral to the restricted committee. It held that the competent public prosecutor had been informed in advance of the inspection and that the restricted committee had been validly seized and convened. Second, the Court found that the controller’s rights of defence had been breached in relation to one of the violations. The DPA’s report had alleged that the controller had engaged in unfair processing under GDPR Article 5 because it led users to believe that all transfers were based on consent, while some data was transferred on the basis of legitimate interest and without an option to object. However, the final decision requalified this issue as a breach of GDPR Article 6 for failure to obtain prior consent. Since this specific legal ground had not been included in the report communicated to the controller, the controller had not been able to comment on it. The Court therefore annulled this part of the DPA’s decision. Third, the Court confirmed that the controller’s consent forms did not meet the requirements of the GDPR. It recalled that consent must be freely given, specific, informed and unambiguous, and that it requires a clear affirmative action by the data subject. Although the forms required a positive action, their design and wording were ambiguous. In particular, the “I agree” option was visually highlighted, while the alternative options were less clear or could be misunderstood by users. Therefore, the forms did not allow valid consent for the transfer of personal data to partners for commercial marketing. Fourth, the Court rejected the controller’s argument that the principle of legality of offences and penalties had been breached. It held that the GDPR rules on consent were sufficiently clear and foreseeable for a professional in the digital marketing sector. As a result, the Court reduced the administrative fine from €75,000 to €50,000, taking into account the annulment of one part of the DPA’s reasoning. However, it upheld the injunction requiring the controller to implement a GDPR-compliant consent form, subject to a daily penalty. The Court also ordered publication of its decision under the same conditions as the DPA’s decision and ordered the DPA to pay €2,000 to the controller for legal costs. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the French original. Please refer to the French original for more details. Council of State No. 492836 ECLI:FR:CECHR:2026:492836.20260520 Unpublished in the Lebon collection 10th - 9th chambers sitting together Mr. Jean de L'Hermite, rapporteur SCP ROCHETEAU, UZAN-SARANO & GOULET, Attorneys at Law. Read on Wednesday, May 20, 2026. FRENCH REPUBLIC. IN THE NAME OF THE FRENCH PEOPLE. Having regard to the following procedure: By a summary application, a supplementary memorandum, and a reply memorandum, registered on March 22, 2024, June 19, 2024, and January 21, 2025, at the Registry of the Litigation Division of the Council of State, the company Tagadamedia requests the Council of State: 1) to annul Decision No. SAN-2023-025 of the restricted panel of the National Commission for Information Technology and Civil Liberties (CNIL) dated December 29, 2023, imposing an administrative fine of €75,000 for breaches of Articles 6 and 30 of the General Data Protection Regulation (GDPR), ordering it, under penalty of €1,000 per day of delay, to implement, within one month of notification of this decision... 1) a decision requiring the CNIL to publish, on the websites it operates, a data collection form for prospective customers that allows for the collection of free, specific, informed, and unambiguous consent regarding the transmission of personal data to partners for marketing purposes, and ordering the publication of this decision on the websites of the CNIL and Légifrance under conditions that prevent the company from being identified by name after a period of two years from this publication; 2) in the alternative, to amend the contested decision by reducing the amount of the penalty imposed and to order the CNIL to publish the amending decision on its website and on the Légifrance website; 3) to order the CNIL to pay the sum of €6,000 pursuant to Article L. 761-1 of the Code of Administrative Justice. Having regard to the other documents in the file; Having regard to: - the Constitution, and in particular its Preamble; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - Regulation (EU) 2016\u002F679 of the European Parliament and of the Council of 26 April 2016; - Law No. 78-17 of 6 January 1978; - Decree No. 2019-536 of 29 May 2019; - the Code of Administrative Justice; After hearing in open court: - the report of Mr. Jean de L'Hermite, State Councillor, - the submissions of Mr. Frédéric Puigserver, Public Rapporteur; After the submissions, the floor was given to SCP Rocheteau, Uzan-Sarano and Goulet, counsel for Tagadamedia; Considering the following: 1. Tagadamedia, whose business consists of organizing competitions on the websites it manages and transmitting, for remuneration, the personal data of participants, including their names, postal and email addresses, and telephone numbers, to its commercial partners for marketing purposes, requests the annulment of the decision of December 29, 2023, by which the restricted panel of the National Commission for Information Technology and Civil Liberties (CNIL) imposed an administrative fine of €75,000 on it for breaches of Articles 6 and 30 of the General Data Protection Regulation (GDPR). data protection (GDPR), ordered it, under penalty of 1,000 euros per day of delay after a period of one month following notification of this decision, to implement on the sites it publishes a data collection form for prospects allowing for the collection of free, specific, informed and unambiguous consent to the transmission of their personal data to partners and decided to make this decision public, accompanying it with an anonymization procedure at the expiry of a period of two years. On the regularity of the contested decision: 2. Firstly, it appears from the investigation that, by letter dated May 13, 2022, received by its recipient the same day, the President of the CNIL informed the Public Prosecutor at the Paris Judicial Court, within whose jurisdiction the premises of Tagadamedia were located, of the date, time, and purpose of the on-site verification mission that the Commission had decided to carry out at these premises on May 18 and 19, 2022. Consequently, the argument that the obligation, stipulated by the provisions of Articles 19 of the Law of January 6, 1978, and 25 of the Decree of May 29, 2019, issued for its implementation, to inform the territorially competent Public Prosecutor at least twenty-four hours before the date of the visit by members of the CNIL and its agents authorized for this purpose to the premises used for the processing of personal data, was disregarded, can only be dismissed.3. Secondly, under Article 20 of the Law of 6 January 1978, in its version applicable to the dispute: \"(...) III. When the data controller or its processor fails to comply with the obligations arising from Regulation (EU) 2016\u002F679 of 27 April 2016 or from this Law, the President of the National Commission for Information Technology and Civil Liberties may also (...) refer the matter to the restricted panel of the Commission for the imposition, after adversarial proceedings, of one or more of the following measures: \u002F (...) 7° (...) an administrative fine (...)\". Under Article 61 of the CNIL's Rules of Procedure: \"The restricted panel meets when convened by its Chair or, in the event of absence or impediment, by its Vice-Chair. \u002F The notice of meeting specifies the place, date, time, and agenda. It is sent electronically or by any other means.\" It is communicated to the members of the restricted panel, to the rapporteurs whose files are on the agenda for the session, and to the government commissioner.\" 4. The investigation reveals, firstly, that by letter dated June 22, 2023, the president of the CNIL informed the members and the president of the restricted panel of her decision to refer the matter to it with a view to issuing one or more of the measures provided for in Article 20 of the Law of January 6, 1978, against the company Tagadamedia and, secondly, that by email dated November 28, 2023, the members of the restricted panel were duly summoned to the session held on December 7, 2023, the agenda of which included the examination of the report relating to this case. Consequently, the argument that the restricted panel was not duly seized and summoned, in violation of the provisions of the Law of January 6, 1978, and of the The CNIL's internal regulations must be disregarded. 5. Thirdly, according to Article 69 of the CNIL's internal regulations: \"Decisions adopted by the restricted panel are called \"deliberations\". They are signed by the chair of the panel (...). They (...) bear the date of their signature.\" It appears from the investigation, and in particular from the attendance sheet produced by the CNIL (French Data Protection Authority), that Ms. A... was not present at the session of December 7, 2023, during which the case was examined and deliberated. The fact that, due to a purely clerical error, the contested deliberation mentions her name among the members of the restricted panel does not render it irregular. Regarding the violation of the rights of the defense: 6. According to Article 16 of the Declaration of the Rights of Man and of the Citizen of 1789: \"Any society in which the guarantee of rights is not secured, nor the separation of powers determined, has no Constitution.\" This provision implies, in particular, that no sanction of a punitive nature may be imposed on a person without that person having been given the opportunity to present their observations on the facts with which they are charged. Concerning the In the case of punitive measures, respect for the general principle of the rights of the defense requires that the person concerned be informed, with sufficient precision and within a reasonable time before the pronouncement of the sanction, of the grievances made against him and be able to have access to the documents on the basis of which the breaches were established, at the very least when he makes the request.7. According to Article 22 of the Law of 6 January 1978 in its version applicable to the dispute: \"The measures provided for in III of Article 20 (...) of this Law shall be pronounced on the basis of a report drawn up by one of the members of the National Commission for Information Technology and Freedoms, designated by the President of the latter from among the members not belonging to the restricted formation. This report is notified to the data controller or its processor, who may submit observations and be represented or assisted.” According to Article 5 of the General Data Protection Regulation: “Personal data shall be: a) processed lawfully, fairly and transparently in relation to the data subject (...).” According to Article 6 of the same regulation: “1. Processing shall be lawful only if and to the extent that at least one of the following conditions is met: \u002F a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes (...).” 8. It appears from the investigation that the report adopted pursuant to Article 22 of the Law of 6 January 1978, notified to Tagadamedia to allow it to submit its observations and on the basis of which the contested decision was taken, noted that, when a participant in a competition organized by the company had not consented to the Regarding the transmission of his personal data, the company refrained from transmitting his email address to its partners but nevertheless transmitted to them the address and telephone number of this participant.The report proposed that the restricted panel conclude that by leading users to believe that all their data was transmitted on the basis of their consent, when in fact some data was transmitted, without their knowledge, on the basis of a legitimate interest, and by not providing an option to object to the transmission of this data, the company had implemented unfair data processing, constituting a breach of the obligations provided for by the provisions of Article 5 of the GDPR, to the exclusion of any other grievance. By not upholding this complaint but substituting a separate one, based on the same facts but stemming from the company's failure to comply with the obligation, stipulated in the aforementioned provisions of Article 6 of the Regulation, to obtain the consent of the data subjects prior to any transfer of their personal data, whereas this complaint had not been upheld in the report submitted to the company and it had therefore been unable to submit observations in response on this point, the restricted panel disregarded the principle of the rights of the defense. Consequently, the applicant company is entitled to request the annulment of the contested decision insofar as it upholds this breach. Regarding the breaches of the rules relating to consent: 9. Article 6(a) of the GDPR, cited in point 7, provides that the consent of the data subject is one of the possible bases for the processing of personal data. Article 4, paragraph 11 of the same regulation specifies that consent means \"any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.\" According to Article 7 of the same regulation: \"1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has given consent to the processing of personal data relating to him or her. \u002F 2. Where the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a form which is clearly distinguishable from those other matters, in an intelligible and easily accessible format, and in clear and plain language (...).\" It follows from these provisions, as interpreted by the Court of Justice of the European Union in its judgment C-673\u002F17 of 1 October 2019, that free, specific, informed, and unambiguous consent can only be express consent from the user, given with full knowledge of the facts and after adequate information on the use that will be made of their personal data.10. The investigation revealed that during the period covered by the CNIL's audits, Tagadamedia used two different consent forms for individuals wishing to participate in the competitions it organized on the websites it managed. The first of these forms included, below the fields allowing participants to enter their contact details, a single button printed with the words \"I confirm\". Above this button, text in significantly smaller font explained that by checking the box, the user agreed to the use of the collected data to send them offers from the company's partners. Hyperlinks provided access to the data protection policy and the list of participating partners. The text concluded by stating that if the user wished to continue without receiving offers from the company's partners, they could click on a link within the text labeled \"I click here.\" Another checkbox allowed users to accept the terms and conditions of the transaction. The second form, implemented in 2017, included, below the fields allowing users to enter their contact information, two buttons labeled \"I accept\" and, in smaller font, \"I decline.\" Above these buttons, text in a significantly smaller font size explained that by checking the \"I confirm\" button, the user agreed to the use of the collected data to send them offers from the company's partners. Another checkbox allowed users to accept the terms of the transaction.11 These forms made the consent of the individuals concerned to the transmission of their personal data for processing for marketing purposes contingent upon a positive action, namely checking the \"I confirm\" button, and the information provided on the forms specified the consequences of this consent. However, the restricted panel correctly determined that these forms did not allow for free, specific, informed, and unambiguous consent from users within the meaning of Article 6 of the GDPR, since the \"I confirm\" button was highlighted and ambiguities remained regarding the consequences of clicking the other button. Regarding compliance with the principle of legality of offenses and penalties: 12. The principle of legality of offenses and penalties, which extends to any sanction of a punitive nature, precludes an administrative authority from imposing a sanction if, at the time of the events in question, the rule in question is not sufficiently clear, such that it does not appear reasonably foreseeable to the professionals concerned that the conduct in question is liable to be sanctioned. 13. The applicant company argues that while the CNIL (French Data Protection Authority) had published recommendations on commercial prospecting at the time of the events that led to the disputed sanction, these recommendations were not very representative of the practices in the digital marketing sector in which it operates. However, the provisions of the GDPR relating to obtaining consent, when it constitutes the declared basis for automated processing of personal data, clearly established the need for unambiguous consent from the data subjects. Consequently, the argument based on the contested decision's failure to comply with the constitutional principle of legality of offenses and penalties must be dismissed. Regarding the amount of the administrative fine: 14. It follows from the foregoing that Tagadamedia is entitled to request the amendment of the decision it is challenging insofar as it characterized as a breach of Article 6 of the GDPR the conditions under which some of the personal data of users of the websites it publishes were transmitted to its partners without the data subjects' consent. Under these circumstances, the amount of the administrative fine imposed by the contested decision should be amended. A fair assessment of all the circumstances of the case will be made by reducing the amount of this fine to €50,000. Regarding the injunction issued by the contested decision: 15. The investigation reveals that, after Tagadamedia was notified of the report outlining the charges on which the restricted panel was to rule, the company expressed its intention to implement a new consent form. Below the fields allowing data subjects to enter their contact information, there were two identical-looking buttons, labeled \"I agree\" and \"Next step,\" respectively. Above these buttons, text in a significantly smaller font size explained that by clicking the \"I agree\" button, the user consented to the use of the collected data to send them offers from the company's partners. By clicking the \"next step\" button, the user continued their registration for the contest without receiving offers from partners.16 This form made the consent of the individuals concerned to the transmission of their personal data for processing for marketing purposes contingent upon an affirmative action on their part. It provided explanations of the consequences of the two options offered by the two buttons, which were identical in size, font, and color. However, by noting that the wording of these two buttons led the user to believe that they represented the two successive stages of the registration process and not the choice between consenting to the transmission of their personal data and refusing such consent, and that the text above the two buttons did not clarify the ambiguity, given its general appearance and small font size, the CNIL's restricted panel did not err in its assessment by concluding that this third form, due to its ambiguous nature, did not meet the GDPR's requirements for obtaining consent and, consequently, ordering Tagadamedia, under penalty of a fine, to implement a form compliant with these requirements on the websites it publishes. Therefore, the applicant company is not entitled to request the annulment of the contested decision insofar as it issued this injunction. Regarding the publication of the sanction: 17. This decision, which amends the amount of a penalty imposed by the contested deliberation, published on the CNIL website and on the Légifrance website, requires the CNIL to ensure its publication in the same manner as it used for its deliberation. Regarding the claims under Article L. 761-1 of the Code of Administrative Justice: 18. The CNIL is ordered to pay the company Tagadamedia the sum of €2,000 pursuant to the provisions of Article L. 761-1 of the Code of Administrative Justice. DECIDES: -------------- Article 1: The amount of the administrative fine imposed on Tagadamedia by the CNIL's restricted panel decision of December 29, 2023, is reduced to €50,000. Article 2: The CNIL's restricted panel decision of December 29, 2023, is amended insofar as it conflicts with this decision. Article 3: This decision will be published on the CNIL website and on the Légifrance website under the same conditions as the amended decision. Article 4: The CNIL will pay Tagadamedia the sum of €2,000 pursuant to Article L. 761-1 of the French Code of Administrative Justice. Article 5: The remaining claims in the application are dismissed. Article 6: This decision will be notified to Tagadamedia and the French Data Protection Authority (CNIL).","France's Supreme Administrative Court (Conseil d'État) partially upheld an appeal by Tagadamedia, a lead generation company that organized online competitions and sold participant data to marketing partners. The court reduced the CNIL fine from €75,000 to €50,000 and annulled one breach finding due to procedural rights violations, but upheld that the company's consent forms failed to meet GDPR Article 6 requirements—particularly because they used ambiguous button designs and emphasized consent options over rejection.","French court reduces CNIL fine against lead generation company from €75K to €50K for invalid GDPR consent forms.","Help CE - No. 492836: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 07:13, 28 May 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators47 edits Tag: submission [1.0] (No difference) Latest revision as of 07:13, 28 May 2026 CE - No. 492836 Court: CE (France) Jurisdiction: France Relevant Law: Article 4(11) GDPR Article 6 GDPR Article 7 GDPR Article 30 GDPR Decided: 20.05.2026 Published: Parties: Tagadamedia CNIL National Case Number\u002FName: No. 492836 European Case Law Identifier: ECLI:FR:CECHR:2026:492836.20260520 Appeal from: CNILSAN-2023-025 Appeal to: Original Language(s): French Original Source: Conseil d'État (in French) Initial Contributor: bms The Court reduced a CNIL fine against a lead generation company from €75,000 to €50,000 but upheld that its consent forms did not validly collect GDPR consent. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts Tagadamedia, the controller, organised online competitions on websites it managed. In this context, it collected participants’ personal data, including names, postal addresses, email addresses and telephone numbers. It then transferred this data to commercial partners for marketing purposes in exchange for payment. The DPA, carried out an on-site inspection at the controller’s premises and later initiated sanction proceedings. The DPA found that the controller’s consent mechanisms did not allow users to give free, specific, informed and unambiguous consent to the transfer of their data to partners for marketing purposes. The controller had used different versions of consent forms. One version displayed a prominent “I agree” button, while the option to continue without receiving partner offers was only available through a less visible link in smaller text. Another version included two buttons, “I agree” and “I decline”, but the visual presentation continued to emphasise consent. The controller later proposed a new form with two similar buttons, “I agree” and “Next step”. The DPA imposed a €75,000 administrative fine for breaches of GDPR Articles 6 and 30. It also ordered the controller, under a daily penalty of €1,000, to implement a compliant form collecting valid consent for the transfer of data to partners. The controller appealed the decision before the Court. Holding The Court partly upheld the appeal. First, the Court rejected the controller’s procedural arguments regarding the DPA’s inspection and the referral to the restricted committee. It held that the competent public prosecutor had been informed in advance of the inspection and that the restricted committee had been validly seized and convened. Second, the Court found that the controller’s rights of defence had been breached in relation to one of the violations. The DPA’s report had alleged that the controller had engaged in unfair processing under GDPR Article 5 because it led users to believe that all transfers were based on consent, while some data was transferred on the basis of legitimate interest and without an option to object. However, the final decision requalified this issue as a breach of GDPR Article 6 for failure to obtain prior consent. Since this specific legal ground had not been included in the report communicated to the controller, the controller had not been able to comment on it. The Court therefore annulled this part of the DPA’s decision. Third, the Court confirmed that the controller’s consent forms did not meet the requirements of the GDPR. It recalled that consent must be freely given, specific, informed and unambiguous, and that it requires a clear affirmative action by the data subject. Although the forms required a positive action, their design and wording were ambiguous. In particular, the “I agree” option was visually highlighted, while the alternative options were less clear or could be misunderstood by users. Therefore, the forms did not allow valid consent for the transfer of personal data to partners for commercial marketing. Fourth, the Court rejected the controller’s argument that the principle of legality of offences and penalties had been breached. It held that the GDPR rules on consent were sufficiently clear and foreseeable for a professional in the digital marketing sector. As a result, the Court reduced the administrative fine from €75,000 to €50,000, taking into account the annulment of one part of the DPA’s reasoning. However, it upheld the injunction requiring the controller to implement a GDPR-compliant consent form, subject to a daily penalty. The Court also ordered publication of its decision under the same conditions as the DPA’s decision and ordered the DPA to pay €2,000 to the controller for legal costs. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the French original. Please refer to the French original for more details. Council of State No. 492836 ECLI:FR:CECHR:2026:492836.20260520 Unpublished in the Lebon collection 10th - 9th chambers sitting together Mr. Jean de L'Hermite, rapporteur SCP ROCHETEAU, UZAN-SARANO & GOULET, Attorneys at Law. Read on Wednesday, May 20, 2026. FRENCH REPUBLIC. IN THE NAME OF THE FRENCH PEOPLE. Having regard to the following procedure: By a summary application, a supplementary memorandum, and a reply memorandum, registered on March 22, 2024, June 19, 2024, and January 21, 2025, at the Registry of the Litigation Division of the Council of State, the company Tagadamedia requests the Council of State: 1) to annul Decision No. SAN-2023-025 of the restricted panel of the National Commission for Information Technology and Civil Liberties (CNIL) dated December 29, 2023, imposing an administrative fine of €75,000 for breaches of Articles 6 and 30 of the General Data Protection Regulation (GDPR), ordering it, under penalty of €1,000 per day of delay, to implement, within one month of notification of this decision... 1) a decision requiring the CNIL to publish, on the websites it operates, a data collection form for prospective customers that allows for the collection of free, specific, informed, and unambiguous consent regarding the transmission of personal data to partners for marketing purposes, and ordering the publication of this decision on the websites of the CNIL and Légifrance under conditions that prevent the company from being identified by name after a period of two years from this publication; 2) in the alternative, to amend the contested decision by reducing the amount of the penalty imposed and to order the CNIL to publish the amending decision on its website and on the Légifrance website; 3) to order the CNIL to pay the sum of €6,000 pursuant to Article L. 761-1 of the Code of Administrative Justice. Having regard to the other documents in the file; Having regard to: - the Constitution, and in particular its Preamble; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - Regulation (EU) 2016\u002F679 of the European Parliament and of the Council of 26 April 2016; - Law No. 78-17 of 6 January 1978; - Decree No. 2019-536 of 29 May 2019; - the Code of Administrative Justice; After hearing in open court: - the report of Mr. Jean de L'Hermite, State Councillor, - the submissions of Mr. Frédéric Puigserver, Public Rapporteur; After the submissions, the floor was given to SCP Rocheteau, Uzan-Sarano and Goulet, counsel for Tagadamedia; Considering the following: 1. Tagadamedia, whose business consists of organizing competitions on the websites it manages and transmitting, for remuneration, the personal data of participants, including their names, postal and email addresses, and telephone numbers, to its commercial partners for marketing purposes, requests the annulment of the decision o","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CE_-_No._492836&diff=51752&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-05-28T07:13:47+00:00","2026-05-28T08:00:12.447368+00:00",7,[18,21],{"name":19,"type":20},"Tagadamedia","vendor",{"name":22,"type":20},"CNIL","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[]]