CJEU - C-317/25

Summary

The Advocate General of the Court of Justice of the European Union (CJEU) opined that consent for direct marketing purposes given to an undertaking for its unidentified "partners" is not sufficiently informed. A later controller must obtain fresh consent before sending electronic direct marketing. This ruling stems from a case where a controller used data collected by ISPs, where consent was given for "partners" without identification.

Full text

Help CJEU - C-317/25: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 06:31, 23 September 2026 view sourceMba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators984 editsm Tag: Visual edit← Older edit Latest revision as of 08:52, 23 September 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators332 editsTag: Visual edit Line 5: Line 5: |Opinion_Link=https://infocuria.curia.europa.eu/tabs/document/C/2025/C-0317-25-00000000RP-01-P-01/CONCL/326756-EN-1-html|Opinion_Link=https://infocuria.curia.europa.eu/tabs/document/C/2025/C-0317-25-00000000RP-01-P-01/CONCL/326756-EN-1-html |Judgement_Link=https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%2522C%252D317%252F25%2522&publishedId=C-317%2F25|Judgement_Link= |Date_Decided=17.09.2026|Date_Decided=17.09.2026 Line 98: Line 98: }}}} An AG opined that consent to marketing by unidentified “partners” is not sufficiently informed. A later controller must obtain fresh consent before sending electronic direct marketing.The Advocate General opined that consent for direct marketing purposes given to an undertaking for its unidentified “partners” is not sufficiently informed. Such a partner must obtain a new consent before performing direct marketing. ==English Summary====English Summary== Latest revision as of 08:52, 23 September 2026 CJEU - C-317/25 Court: CJEU Jurisdiction: European Union Relevant Law: Article 4(11) GDPR Article 13 GDPR Article 14 GDPR Article 13 ePrivacy DirectiveArticle L. 34-5 of the French Post and Electronic Telecommunications Code (CPCE)Article 4 de la loi 78-17 du 6 janvier 1978 Decided: 17.09.2026 Parties: Commission nationale de l’informatique et des libertés (CNIL) Syndicat professionnel Data et Marketing France (DMA France) Association Alliance Digitale Syndicat Collectif pour les acteurs du marketing digital (CPA) Association Le Groupement des éditeurs de contenus et services en ligne (GESTE) Case Number/Name: C-317/25 European Case Law Identifier: Reference from: Conseil d’ÉtatSAN-2023-015 Language: 24 EU Languages Original Source: AG Opinion Initial Contributor: bms The Advocate General opined that consent for direct marketing purposes given to an undertaking for its unidentified “partners” is not sufficiently informed. Such a partner must obtain a new consent before performing direct marketing. Contents 1 English Summary 1.1 Facts 1.2 Advocate General Opinion 1.3 Holding 2 Comment 3 Further Resources English Summary Facts In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the CJEU for a preliminary ruling. Advocate General Opinion The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under Article 4(11) GDPR. For consent to be informed, the data subject must in particular know the identity of the controller carrying out the marketing. Therefore, consent to the use of personal data by an ISP’s unspecified “partners” does not amount to consent to receive marketing from any undertaking falling within that category. Where the controller’s identity was unknown when consent was obtained, fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An unsubscribe option in that communication cannot remedy the absence of prior consent. The AG therefore considered it unnecessary to answer the second question. In the alternative, the AG considered that the category of recipients must be sufficiently precise for the data subject to reasonably expect to be contacted by the undertaking concerned, and that the term “partners” was too vague. Holding TBD. Comment Share your comments here! Further Resources Share blogs or news articles here! Retrieved from "https://gdprhub.eu/index.php?title=CJEU_-_C-317/25&oldid=53179" Categories: Opinions of the AG of the CJEUEuropean UnionArticle 4(11) GDPRArticle 13 GDPRArticle 14 GDPR2026 This page was last edited on 23 September 2026, at 08:52. Content is available under Creative Commons Attribution-NonCommercial-ShareAlike unless otherwise noted. Privacy policy About GDPRhub Disclaimers

Entities