AG says concept of "partners" too vague to permit marketing without new consent

The Court of Justice of the European Union (CJEU) Advocate General (AG) Dean Spielmann has issued a non-binding Opinion in Case C-317/25, concluding that consent given to an undertaking for unidentified partners to process personal data for direct marketing is legally invalid.

AG Spielmann outlined that valid consent must be freely given, specific, informed, and unambiguous, which strictly requires enabling individuals to know the data controller's identity. As a consequence, consenting to data sharing with "partners" of an internet service provider (ISP) does not authorise commercial communications from any number of organisations within that category. Where the controller's identity was not established at the point of collection, the controller must secure fresh consent before marketing begins, or at the latest during the first communication. Furthermore, offering an unsubscribe option upon first contact cannot rectify the absence of mandatory prior consent.

The opinion follows an appeal by Groupe Canal+ against a €600,000 fine issued by the French data protection authority, the CNIL, after the broadcaster targeted 3.9 million subscribers obtained from ISPs under an unidentified partner clause.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.