[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT6VUQEKMt4OHA7NkC_r7lFQqkYGoq4iBED-NOdC0gNw":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"4ac099df-ba69-4f10-afa7-35c6588cff46","CJEU - C-317\u002F25","cjeu-c-317-25-a36c1f","Facts ← Older revision Revision as of 06:31, 23 September 2026 Line 107: Line 107: When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcodes\u002Ftexte_lc\u002FLEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and [[Article 7 GDPR|Article 7(1) GDPR]] because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed.","A French Data Protection Authority (DPA) fined an ISP €600,000 for invalid consent regarding direct marketing. The ISP's \"partners\" were not identified, meaning subscribers did not know their data could be used by unknown entities. The case reached the French Supreme Court, which referred questions to the CJEU regarding whether consent given to a data collector for marketing by a category of recipients allows an unidentified member of that category to conduct direct marketing without new consent.","CJEU case C-317\u002F25 questions consent validity for unidentified marketing partners.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-317\u002F25&diff=53157&oldid=53155","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-23T06:31:34+00:00","2026-09-23T08:00:09.411889+00:00",7,[17],{"name":18,"type":19},"ISP","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"isp-fined-600k-for-vague-consent-practices-in-direct-marketing","ISP Fined €600K for Vague Consent Practices in Direct Marketing","A French ISP failed to adequately identify its marketing 'partners' in consent disclosures, meaning subscribers could not make informed decisions about how their data would be used or by whom. Under GDPR, valid consent requires that data subjects are clearly informed of all parties who will process their data — vague category-level disclosures do not meet this standard. This case illustrates that consent obtained without naming specific third-party recipients is legally insufficient, exposing organizations to significant regulatory fines. The referral to the CJEU signals that this issue has broad EU-wide implications for any organization relying on bundled or categorical consent for marketing partnerships.",[53,54,55,56,57,58,59,60,61],"GDPR Article 4(11) — Definition of valid consent","GDPR Article 7 — Conditions for consent","GDPR Article 13 — Information to be provided at point of collection","GDPR Article 5(1)(a) — Lawfulness, fairness, and transparency principle","NIST SP 800-53 IP-1 (Consent)","NIST SP 800-53 IP-2 (Individual Access)","CIS Control 3 — Data Protection","ISO\u002FIEC 27701 — Privacy Information Management (PIMS)","CNIL Guidelines on Consent and Direct Marketing (France)",{}]