If an individual agrees to their personal data being used for marketing by an organisation’s “partners”, without knowing who those partners are, can any of them later rely on that permission for direct marketing without obtaining fresh consent?
In Case C-317/25, Groupe Canal+, Advocate General Dean Spielmann (the “AG”) considers that they cannot and that a partner whose identity was unknown at the time the original consent was given must obtain fresh consent before conducting electronic direct marketing.
The AG’s Opinion of 17 September 2026 (the “Opinion”) addresses a recurring problem for entities acquiring marketing data, that is: ‘How far does the original consent travel?’ The answer has nuance, and it turns principally on what the individual knew when agreeing.
The case concerns electronic marketing campaigns commissioned by Groupe Canal+ in 2021, targeting approximately 3.9 million individuals. Two internet service providers (“ISPs”) had collected their data and obtained consent to marketing by the ISPs’ “partners”, without identifying who those partners were. The French Data Protection Authority (CNIL) found that Groupe Canal+ lacked valid consent, and its decision of 12 October 2023 (available in French) imposed a €600,000 fine for several breaches, including this consent failure. Groupe Canal+ appealed to the Conseil d’État, which referred questions on informed consent to the Court of Justice.
The dispute therefore turns on whether the original permission amounted to valid, informed consent. Article 13(1) of the ePrivacy Directive requires prior consent for the electronic marketing at issue. Further, article 4(11) GDPR supplies the required standard, namely that consent must be freely given, specific, informed and unambiguous. Para. 65 of the EDPB’s Consent Guidelines 05/2020 (the “Guidelines”), upholds that other controllers wishing to rely on the original consent should all be named whilst processors need not be named as a condition of consent. Thus, a service provider acting on instructions occupies a different role from a business using a purchased list for its own campaigns. Indeed, articles 13 and 14 GDPR permit disclosure of recipients or recipient categories, but that transparency rule does not itself establish valid consent to another controller’s marketing.
In his Opinion, the AG rejected two arguments advanced by Groupe Canal+ in defence of its reliance on the original consent. First, he rejected the suggestion that an unsubscribe link in the first marketing communication could remedy the absence of valid prior consent. The ability to withdraw consent after marketing has begun cannot retrospectively supply the permission required before it takes place. Secondly, he rejected the notion of “consent fatigue” as a justification for dispensing with fresh consent.
The practical question is therefore whether a business acquiring marketing data can demonstrate that the original consent covers its intended campaign. A supplier’s assurance alone does not establish what each individual agreed to. Article 7(1) GDPR places the burden of demonstrating consent on the controller, while para. 108 of the Guidelines calls for evidence of when and how consent was obtained and what information was presented.
To date, the Opinion is non-binding, and the Court’s judgment remains pending. Our view is that due diligence should test the proposed use against the permission actually obtained, with unresolved gaps addressed ex ante. Further, the naming of a business today does not prove that it was identified to the individual when yesterday’s consent was given.
For more information regarding the ePrivacy Directive, the GDPR, and their interaction, do not hesitate to contact us at info@gtg.com.mt
Author: Dr J.J. Galea; and Dr Mattea Pullicino