CJEU - C-317/25
CJEU AG: Consent for unidentified "partners" in direct marketing is not sufficiently informed.
The Advocate General of the Court of Justice of the European Union (CJEU) opined that consent for direct marketing purposes given to an undertaking for its unidentified "partners" is not sufficiently informed under GDPR. The case involves Groupe Canal+ which used personal data collected by ISPs, where subscribers ticked a box consenting to marketing by the ISP's "partners" without these partners being identified. The AG stated that such a partner must obtain new consent before performing direct marketing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CNIL?
Get an email when a new story names CNIL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU Advocate General found that consent granted to unnamed 'partners' for direct marketing fails GDPR's requirement for informed, specific consent. Groupe Canal+ relied on data collected by ISPs where subscribers consented to marketing by unidentified third parties — a practice the AG ruled insufficient. This matters because organisations cannot launder consent through vague, catch-all language to share personal data with undisclosed recipients. Any partner wishing to use such data for direct marketing must independently obtain fresh, valid consent from each data subject.