CJEU - C-317/25

Summary

The CJEU's Advocate General has opined that consent obtained by ISPs for direct marketing by unidentified "partners" is not sufficiently informed under GDPR. This ruling stems from a case where a data controller was fined €600,000 by a French DPA for violating consent requirements. The national court referred questions to the CJEU regarding whether consent given to a primary collector for marketing by a category of recipients allows an unidentified member of that category to conduct marketing without new consent.

Full text

Help CJEU - C-317/25: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 10:51, 22 September 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators326 editsTag: Visual edit← Older edit Latest revision as of 14:17, 22 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators326 editsTag: Visual edit Line 107: Line 107: When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing.When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine.Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Conseil d’État. It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”.The controller challenged the DPA’s decision before the Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed.The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the Court for a preliminary ruling.The national court stayed the proceedings and referred the questions to the CJEU for a preliminary ruling. === Advocate General Opinion ====== Advocate General Opinion === The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under [[Article 4 GDPR|Article 4(11) GDPR]].The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under [[Article 4 GDPR|Article 4(11) GDPR]]. Latest revision as of 14:17, 22 September 2026 CJEU - C-317/25 Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(11) GDPR Article 13 GDPR Article 14 GDPR Article 13 ePrivacy DirectiveArticle L. 34-5 of the French Post and Electronic Telecommunications Code (CPCE)Article 4 de la loi 78-17 du 6 janvier 1978 Decided: 17.09.2026 Parties: Commission nationale de l’informatique et des libertés (CNIL) Syndicat professionnel Data et Marketing France (DMA France) Association Alliance Digitale Syndicat Collectif pour les acteurs du marketing digital (CPA) Association Le Groupement des éditeurs de contenus et services en ligne (GESTE) Case Number/Name: C-317/25 European Case Law Identifier: Reference from: Conseil d’ÉtatSAN-2023-015 Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: bms An AG opined that consent to marketing by unidentified “partners” is not sufficiently informed. A later controller must obtain fresh consent before sending electronic direct marketing. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the CJEU for a preliminary ruling. Advocate General Opinion The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under Article 4(11) GDPR. For consent to be informed, the data subject must in particular know the identity of the controller carrying out the marketing. Therefore, consent to the use of personal data by an ISP’s unspecified “partners” does not amount to consent to receive marketing from any undertaking falling within that ca

Entities