CJEU - C-317/25

Summary

The CJEU Advocate General opined that consent for electronic direct marketing by unidentified "partners" is not sufficiently informed under Article 4(11) of the GDPR. This ruling stems from a case where Groupe Canal+ SAS conducted marketing campaigns using data collected by ISPs, who did not identify their partners on the consent form. The AG considered the term "partners" too vague and that recipients must be clearly defined for data subjects to reasonably expect contact.

Full text

Help CJEU - C-317/25: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 10:04, 22 September 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators315 edits Tag: Decisions [1.0] Latest revision as of 10:51, 22 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators315 editsTag: Visual edit (One intermediate revision by the same user not shown)Line 103: Line 103: === Facts ====== Facts === In 2021, Groupe Canal + SAS, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs).In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing.When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Line 114: Line 114: The national court stayed the proceedings and referred the questions to the Court for a preliminary ruling.The national court stayed the proceedings and referred the questions to the Court for a preliminary ruling. === Advocate General Opinion ====== Advocate General Opinion === The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under [[Article 4 GDPR|Article 4(11) GDPR]].The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under [[Article 4 GDPR|Article 4(11) GDPR]]. Line 125: Line 122: The AG therefore considered it unnecessary to answer the second question. In the alternative, the AG considered that the category of recipients must be sufficiently precise for the data subject to reasonably expect to be contacted by the undertaking concerned, and that the term “partners” was too vague.The AG therefore considered it unnecessary to answer the second question. In the alternative, the AG considered that the category of recipients must be sufficiently precise for the data subject to reasonably expect to be contacted by the undertaking concerned, and that the term “partners” was too vague. === Holding ====== Holding === TBD.TBD. Latest revision as of 10:51, 22 September 2026 CJEU - C-317/25 Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(11) GDPR Article 13 GDPR Article 14 GDPR Article 13 ePrivacy DirectiveArticle L. 34-5 of the French Post and Electronic Telecommunications Code (CPCE)Article 4 de la loi 78-17 du 6 janvier 1978 Decided: 17.09.2026 Parties: Commission nationale de l’informatique et des libertés (CNIL) Syndicat professionnel Data et Marketing France (DMA France) Association Alliance Digitale Syndicat Collectif pour les acteurs du marketing digital (CPA) Association Le Groupement des éditeurs de contenus et services en ligne (GESTE) Case Number/Name: C-317/25 European Case Law Identifier: Reference from: Conseil d’ÉtatSAN-2023-015 Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: bms An AG opined that consent to marketing by unidentified “partners” is not sufficiently informed. A later controller must obtain fresh consent before sending electronic direct marketing. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Conseil d’État. It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the Court for a preliminary ruling. Advocate General Opinion The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under Article 4(11) GDPR. For consent to be informed, the data subject must in particular know the identity of the controller carrying out the marketing. Therefore, consent to the use of personal data by an ISP’s unspecified “partners” does not amount to consent to receive marketing from any undertaking falling within that category. Where the controller’s identity was unknown when consent was obtained, fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An unsubscribe option in that communication cannot remedy the absence of prior consent. The AG therefore considered it unnecessary to answer the second question. In the alternative, the AG considered that the category of recipients must be sufficiently precise for the data subject to reasonably expect to be contacted by the undertaking concerned, and that the term “partners” was too vague. Holding TBD. Comment Share your comments here! Further Resources Share blogs or news articles here! Retrieved from "https://gdprhub.eu/index.php?title=CJEU_-_C-317/25&oldid=53141" Categories: CJEUEuropean UnionArticle 4(11) GDPRArticle 13 GDPRArticle 14 GDPR2026 This page was last edited on 22 September 2026, at 10:51. Content is available under Creative Commons Attribution-NonCommercial-ShareAlike unless otherwise noted. Privacy policy About GDPRhub Disclaimers

Entities