Tagadamedia – Court Ruling (France, 2026)

Tagadamedia, the controller, organised online competitions on websites it managed. In this context, it collected participants’ personal data, including names, postal addresses, email addresses and telephone numbers. It then transferred this data to commercial partners for marketing purposes in exchange for payment. The DPA, carried out an on-site inspection at the controller’s premises and later initiated sanction proceedings. The DPA found that the controller’s consent mechanisms did not allow users to give free, specific, informed and unambiguous consent to the transfer of their data to partners for marketing purposes. The controller had used different versions of consent forms. One version displayed a prominent “I agree” button, while the option to continue without receiving partner offers was only available through a less visible link in smaller text. Another version included two buttons, “I agree” and “I decline”, but the visual presentation continued to emphasise consent. The controller later proposed a new form with two similar buttons, “I agree” and “Next step”. The DPA imposed a €75,000 administrative fine for breaches of GDPR Articles 6 and 30. It also ordered the controller, under a daily penalty of €1,000, to implement a compliant form collecting valid consent for the transfer of data to partners. The controller appealed the decision before the Court. The Court partly upheld the appeal. First, the Court rejected the controller’s procedural arguments regarding the DPA’s inspection and the referral to the restricted committee. It held that the competent public prosecutor had been informed in advance of the inspection and that the restricted committee had been validly seized and convened. Second, the Court found that the controller’s rights of defence had been breached in relation to one of the violations. The DPA’s report had alleged that the controller had engaged in unfair processing under GDPR Article 5 because it led users to believe that all transfe