CJEU - C-317/25
CJEU Advocate General rules consent for marketing by unidentified partners is invalid.
The CJEU's Advocate General has opined that consent obtained by ISPs for direct marketing by unidentified "partners" is not sufficiently informed under GDPR. This ruling stems from a case where a data controller was fined €600,000 by a French DPA for violating consent requirements. The national court referred questions to the CJEU regarding whether consent given to a primary collector for marketing by a category of recipients allows an unidentified member of that category to conduct marketing without new consent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA French ISP's practice of obtaining blanket consent for marketing by unnamed 'partner' categories was found insufficiently specific under GDPR, resulting in a €600,000 fine. GDPR Article 4(11) requires consent to be informed, specific, and unambiguous — meaning data subjects must know exactly who will process their data and for what purpose. Allowing unidentified third parties to conduct marketing under a vague categorical consent undermines the fundamental right of individuals to control their personal data. This ruling reinforces that consent obtained through deliberately opaque language is legally invalid, exposing organizations to significant regulatory penalties. Data controllers cannot use intermediary collection as a shield to obscure downstream processing relationships.