CJEU - C-317/25
CJEU case C-317/25 questions consent validity for unidentified marketing partners.
A French Data Protection Authority (DPA) fined an ISP €600,000 for invalid consent regarding direct marketing. The ISP's "partners" were not identified, meaning subscribers did not know their data could be used by unknown entities. The case reached the French Supreme Court, which referred questions to the CJEU regarding whether consent given to a data collector for marketing by a category of recipients allows an unidentified member of that category to conduct direct marketing without new consent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ISP?
Get an email when a new story names ISP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA French ISP failed to adequately identify its marketing 'partners' in consent disclosures, meaning subscribers could not make informed decisions about how their data would be used or by whom. Under GDPR, valid consent requires that data subjects are clearly informed of all parties who will process their data — vague category-level disclosures do not meet this standard. This case illustrates that consent obtained without naming specific third-party recipients is legally insufficient, exposing organizations to significant regulatory fines. The referral to the CJEU signals that this issue has broad EU-wide implications for any organization relying on bundled or categorical consent for marketing partnerships.