An Advocate General has advised the Court of Justice that consent given to an internet service provider for data use by its unnamed partners cannot support later electronic direct marketing by one of those partners without fresh consent
Europa. In the 17 September 2026 Opinion in Case C-317/25Europa, Advocate General Spielmann proposes that Article 4(11) GDPR, with Articles 13 and 14 GDPR and Article 13 of Directive 2002/58, be read so that partner-category consent whose recipients were unknown at collection is not informed consent for marketing by any member of that categoryEuropa. The Opinion proposes an answer; the Court's ruling on interpretation will guide the Conseil d'Etat, before which the appeal against the CNIL fine is pending.
The reference comes from the Conseil d'EtatEuropa in Groupe Canal + SAS's challenge to CNIL Decision SAN-2023-015Europa of 12 October 2023Europa, which fined the company EUR 600 000Europa for electronic direct marketing without valid consentEuropa. Individuals had consented at collection by internet service providers to transfers for unsolicited commercial communications to partners who were not identified when consent was givenEuropa. Groupe Canal +, not specifically named among those partnersEuropa, then marketed to themEuropa; it argues the ISP consent was sufficiently informedEuropa, while the CNIL, the Commission and the French and Spanish governments disagreeEuropa; Italy made written submissions whose position the Opinion does not record. The referring court asks first whether category consent suffices or each unidentified recipient must obtain consent as new controllerEuropa, and second how precise a recipient category must beEuropa.
On the first question the Opinion reasons from wording, context and objectives. Article 13(1) of Directive 2002/58 permits electronic direct marketing only to subscribers who gave prior consentEuropa, and that consent means GDPR consent: freely given, specific, informed and unambiguous indication by statement or clear affirmative actionEuropa. Informed consent requires the information in Articles 13 and 14 GDPREuropa, and at the marketing stage the data arrive indirectly, so Article 14 appliesEuropa: the controller must identify itself under Article 14(1)(a)Europa and inform at the latest at first communication under Article 14(3)(b)Europa. Recital 42 GDPR states the subject should know at least the controller's identity and the purposes. The Article 13(2) soft opt-in for a seller's own similar products does not apply because the marketer is not the collecting ISPEuropa.
Context points the same way: transparency and fairness under Article 5(1)(a) GDPR with recitals 60 and 61 require subjects to be told of recipient changes so they can assess impact and exercise withdrawal or objection rightsEuropa, and the Article 14(5) exceptions are exhaustively listed and inapplicableEuropa — the identity was never disclosedEuropa, and informing does not take disproportionate effort since Groupe Canal + could contract with ISPs to name recipients or keep an updated list, or seek consent itself by first contactEuropa. An unsubscribe link cures nothing retrospectivelyEuropa. The Deutsche Telekom and Proximus directory case-law, allowing one consent across same-purpose directory operationsEuropa, concerns Article 12 of Directive 2002/58Europa and even requires renewed consent for additional purposesEuropa, so it does not help Groupe Canal +.
In the alternative on the second question, the Opinion prefers a precision-sensitive approach: a recipient category could carry consent only if the subject can reasonably expect contact from that person given the collection contextEuropa, and ISP partners is too vagueEuropa — a contractual-commercial relationship that says nothing about goods, services, sector or locationEuropa, contrary to the Article 29 Working Party transparency guidanceEuropa. The vaguer the category, the less likely valid consent results. The legal basis is one closing sentence: the proposed reading applies Article 4(11) with Articles 13 and 14 GDPR and Article 13 of Directive 2002/58Europa.
Audit partner-based prospecting lists for marketing recipients unnamed at collection and obtain fresh consent by first contact before further electronic direct marketing.
