[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBCdEi_UuWLBG7La2ylg80ReSdlnXlPAo2ELzepV7ibo":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"49aa0708-1f07-4093-b81e-c8804df2d608","CJEU - C-317\u002F25","cjeu-c-317-25-854099","← Older revision Revision as of 14:17, 22 September 2026 Line 107: Line 107: When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article L. 34-5 of the French Post and Electronic Communications Code and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Conseil d’État. It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The controller challenged the DPA’s decision before the Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the proceedings and referred the questions to the Court for a preliminary ruling. The national court stayed the proceedings and referred the questions to the CJEU for a preliminary ruling. === Advocate General Opinion === === Advocate General Opinion === The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under [[Article 4 GDPR|Article 4(11) GDPR]]. The AG opined that consent given to a primary collector for electronic direct marketing by unidentified “partners” is not sufficiently informed under [[Article 4 GDPR|Article 4(11) GDPR]].","The CJEU's Advocate General has opined that consent obtained by ISPs for direct marketing by unidentified \"partners\" is not sufficiently informed under GDPR. This ruling stems from a case where a data controller was fined €600,000 by a French DPA for violating consent requirements. The national court referred questions to the CJEU regarding whether consent given to a primary collector for marketing by a category of recipients allows an unidentified member of that category to conduct marketing without new consent.","CJEU Advocate General rules consent for marketing by unidentified partners is invalid.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-317\u002F25&diff=53155&oldid=53141","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-22T14:17:37+00:00","2026-09-22T16:00:38.482678+00:00",7,[17,20],{"name":18,"type":19},"GDPR","product",{"name":21,"type":19},"French Post and Electronic Communications Code","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,32,37,42],{"category":29},{"id":30,"icon":24,"name":18,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":33},{"id":34,"icon":24,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":24,"name":40,"slug":41},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":43},{"id":22,"icon":24,"name":25,"slug":26},[],[18,21],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":64},"cjeu-rules-vague-consent-to-unidentified-partners-violates-gdpr","CJEU Rules Vague Consent to 'Unidentified Partners' Violates GDPR","A French ISP's practice of obtaining blanket consent for marketing by unnamed 'partner' categories was found insufficiently specific under GDPR, resulting in a €600,000 fine. GDPR Article 4(11) requires consent to be informed, specific, and unambiguous — meaning data subjects must know exactly who will process their data and for what purpose. Allowing unidentified third parties to conduct marketing under a vague categorical consent undermines the fundamental right of individuals to control their personal data. This ruling reinforces that consent obtained through deliberately opaque language is legally invalid, exposing organizations to significant regulatory penalties. Data controllers cannot use intermediary collection as a shield to obscure downstream processing relationships.",[54,55,56,57,58,59,60,61,62,63],"GDPR Article 4(11) — Definition of Consent","GDPR Article 6(1)(a) — Lawfulness of Processing based on Consent","GDPR Article 7 — Conditions for Consent","GDPR Article 13 — Information to be Provided at Collection","GDPR Article 83(5) — Administrative Fines for Consent Violations","NIST Privacy Framework PR.CP-1 — Consent Management","NIST SP 800-53 IP-1 — Consent","CIS Control 3 — Data Protection","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Information Security Policy",{}]