CJEU - C-317/25

Summary

An Advocate General of the Court of Justice of the European Union (CJEU) has opined that consent for electronic direct marketing is invalid if the data subject does not know the identity of the controller or "partners" who will use their data. In a case involving Groupe Canal+ SAS, consent obtained by ISPs for marketing by unidentified partners was deemed insufficient under GDPR. The AG stated that fresh consent is required before such marketing can occur.

Full text

Help CJEU - C-317/25: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 10:04, 22 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators315 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 10:04, 22 September 2026 CJEU - C-317/25 Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(11) GDPR Article 13 GDPR Article 14 GDPR Article 13 ePrivacy DirectiveArticle L. 34-5 of the French Post and Electronic Telecommunications Code (CPCE)Article 4 de la loi 78-17 du 6 janvier 1978 Decided: 17.09.2026 Parties: Commission nationale de l’informatique et des libertés (CNIL) Syndicat professionnel Data et Marketing France (DMA France) Association Alliance Digitale Syndicat Collectif pour les acteurs du marketing digital (CPA) Association Le Groupement des éditeurs de contenus et services en ligne (GESTE) Case Number/Name: C-317/25 European Case Law Identifier: Reference from: Conseil d’ÉtatSAN-2023-015 Language: 24 EU Languages Original Source: AG OpinionJudgement Initial Contributor: bms An AG opined that consent to marketing by unidentified “partners” is not sufficiently informed. A later controller must obtain fresh consent before sending electronic direct marketing. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts In 2021, Groupe Canal + SAS, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Conseil d’État. It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the Court for a preliminary ruling. Advocate General Opinion The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under Article 4(11) GDPR. For consent to be informed, the data subject must in particular know the identity of the controller carrying out the marketing. Therefore, consent to the use of personal data by an ISP’s unspecified “partners” does not amount to consent to receive marketing from any undertaking falling within that category. Where the controller’s identity was unknown when consent was obtained, fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An unsubscribe option in that communication cannot remedy the absence of prior consent. The AG therefore considered it unnecessary to answer the second question. In the alternative, the AG considered that the category of recipients must be sufficiently precise for the data subject to reasonably expect to be contacted by the undertaking concerned, and that the term “partners” was too vague. Holding TBD. Comment Share your comments here! Further Resources Share blogs or news articles here! Retrieved from "https://gdprhub.eu/index.php?title=CJEU_-_C-317/25&oldid=53138" Categories: CJEUEuropean UnionArticle 4(11) GDPRArticle 13 GDPRArticle 14 GDPR2026 This page was last edited on 22 September 2026, at 10:04. Content is available under Creative Commons Attribution-NonCommercial-ShareAlike unless otherwise noted. Privacy policy About GDPRhub Disclaimers

Entities