CALOGA – €80,000 Fine (France, 2025)

CALOGA (the controller) is a company that carries out commercial marketing operations, as well as acting as a data broker. The controller organizes its processing in four databases. One of the services the controller offered was to carry out e-mail marketing campaigns on behalf of companies. To do this, the controller used data collected by data brokers through entry forms for game contests or online product tests. These forms were misleading because the buttons to accept the use of data subjects’ data was much more prominent than those to reject it (this is also known as dark patterns). The controller relied on prior consent given for the initial collectors, and did not allow the data subject to withdraw consent as easily as they had given it. The DPA carried out an on-the-spot investigation of the company in 2022. On June 2024, the DPA rapporteur informed the controller of its breaches of Articles 5(1)(e), 6(1)(a) and 32 GDPR. The controller responded with two arguments- first, it could not foresee that the DPA’s conclusions, as there were no specific recommendations on direct marketing at the time of the inspection. The controller also argued that it had no role in obtaining consent when the data was first collected, and that the contractual and verification measures for the data collected were sufficient. The DPA considered that CALOGA acted as a joint controller for the purposes of transmitting the data to partners (these partners were considered joint controllers). The DPA first dismissed the controller’s foreseeability argument, stating there were rules applicable to direct marketing and consent for several years, and the recommendations on consent through cookies can serve as a guideline for general collection of consent. The DPA also considered the contractual and verifications measures taken by the controller as insufficient. According to Article 7 GDPR, the controller must prove that the data subject has consented to the data processing concerning them. If the controller processes data without collecting the data directly, it also must review the way in which its partners collect consent. The DPA found the controller’s reliance on prior consent unlawful; consent can only be freely given, specific, informed and unambiguous (Article 4(11) GDPR) if the data subject gives express consent after being given adequate information on what the data will be used for. This is supported by CJEU case law such as Planet49, in which the CJEU states that the user’s expression of wishes must relate precisely with the processing and cannot be inferred. Furthermore, any inappropriate influence preventing the data subject from exercising their will renders the consent invalid; this applies to the use of dark patterns, and therefore the controller could not rely on consent as a legal basis (Article 6(1)(a)), given that the conditions for consent were not met. The DPA considered the process of withdrawing consent problematic. National law transposing the [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng ePrivacy Directive] ([https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006070987/ Code des postes et des communications électroniques], Postal and Electronic Communications Code) allows the data subject to withdraw consent to direct marketing. In addition, Article 7(3) GDPR states that withdrawing consent must be as easy as giving it. Following this logic, the data subject should be able to withdraw consent from all databases and advertisers through one link, similarly to how they consented to it. However, unsubscribing through an e-mail link merely withdraws the consent for a specific advertiser or database. The controller did not respect the principle of storage limitation (Article 5(1)(e) GDPR). The controller applied a twelve month retention period from the last action taken by the data subject. This also included opening direct advertising emails. Following this period, the data was still stored for four years in an active database. The DPA considered this excessive. Finally, the DPA did not find a violation of Article 32 GDPR, as there were sufficient data security measures in place.