Consent to messages from unnamed partners does not permit email marketing, says the Advocate General of the Court of Justice

In the Canal+ litigation, which concerns campaigns addressed to approximately 3.9 million people and a fine of 600,000 euros, Dean Spielmann considers that the company’s identity must be known for consent to be informed. Unsubscribing after the first message does not remedy the lack of prior consent, and the Court is not obliged to follow the proposed solution.

Consent given to an internet service provider for the use of personal data by its partners does not allow an unidentified company to send commercial messages by electronic means without a new agreement, considers Advocate General Dean Spielmann. In the Groupe Canal+ case, he proposes that the Court of Justice of the European Union establish that the person must know the identity of the company using their data for marketing. The possibility of unsubscribing after receiving the first message cannot replace prior consent.

In brief

1.The Advocate General considers that consent given for the use of data by unidentified partners does not allow a company to begin electronic marketing without new informed consent.

2.Canal+ argues that the consent obtained by the two internet service providers covered its campaigns. These targeted approximately 3.9 million people, and the company is challenging a fine of 600,000 euros imposed by CNIL.

3.The unsubscribe link does not replace the consent required before marketing, according to Spielmann. He accepts that the provider collecting the data may obtain consent for the identified company that will use it.

4.The conclusions are not a judgment and do not resolve the challenge against the fine. The Court of Justice will interpret EU rules, while the Conseil d’État will decide the national dispute.

The conclusions were presented in Luxembourg on 17 September 2026, in proceedings concerning a fine of 600,000 euros imposed on Canal+ by the French data protection authority, CNIL. They are not binding on the Court and do not resolve the company’s challenge. The case concerns the conditions under which a company may use for its own campaigns data obtained from other companies.

According to the factual background described in the conclusions, Canal+ commissioned electronic marketing campaigns in 2021 targeting approximately 3.9 million people. The data came from two internet service providers whose subscribers had ticked a box accepting the use of their data for partners’ marketing. Those partners were not identified in the form, in a list accessible through a link, or by any other means.

Following complaints and inspections, CNIL found that the company did not have valid consent. Canal+ challenged the decision of 12 October 2023 before the Conseil d’État, seeking its annulment or a reduction of the fine. The company argues that the consent obtained by the internet service providers was sufficiently informed to allow campaigns on its behalf, because the individuals had already accepted the use of their data by those providers’ partners.

Spielmann distinguishes between the transfer of data and its subsequent use for marketing. The General Data Protection Regulation allows, when providing information at the time of collection, categories of recipients to be mentioned. In his view, this possibility does not mean that every member of the category automatically receives the right to send commercial messages. At the campaign stage, the company determining the purposes and means of processing is the controller, and its identity must be known for the person’s consent to be informed.

The argument is based on the requirement of prior consent under the Directive on privacy and electronic communications, read together with the GDPR rules. For electronic advertising addressed to individuals, this is the general rule, CNIL also explains in its guidance. There is an exception for promoting similar products or services to existing customers, with a simple and free right to object. The Advocate General specifies that this exception does not apply to the Canal+ dispute.

The company invoked at the hearing the unsubscribe link available in the first message. Spielmann responds that this allows a subsequent right to be exercised, but does not retroactively remedy the absence of valid consent before marketing began. He also rejects the argument that repeated requests cause consent fatigue, considering that this difficulty does not remove the obligation to provide information and obtain prior consent.

The conclusions do not require consent to be obtained repeatedly in every situation. Spielmann points out that a company may contractually entrust the provider collecting the data with the task of obtaining the consent necessary for marketing, with the recipients identified. In the absence of sufficiently informed consent, the company that is to conduct the campaign must obtain new consent before marketing. The mere fact that it has a commercial relationship with the internet provider is not sufficient.

The Advocate General also examines the alternative in which the Court would accept that a category of recipients may be sufficient. Even then, he considers, the category should be defined so that the person could reasonably expect to be contacted by that company. The generic term partner does not specify the goods or services concerned and remains too vague in this case. This reasoning is subsidiary; the principal solution proposed requires new consent where the controller’s identity was not known.

The Court is to interpret EU law in Case C-317/25. After the judgment is delivered, the French court will resolve the national dispute in accordance with the interpretation given by the European judges. The Advocate General’s conclusions do not, by themselves, uphold or annul the fine imposed on Canal+.

https://2eu.brussels/ro/news/acordul-pentru-mesaje-de-la-parteneri-nenumiti-nu-permite-marketingul-prin-e-mail-sustine-avocatul-general-al-curtii-de-justitie