Tagadamedia – Court Ruling (France, 2026)

Tagadamedia, the controller, organised online competitions on websites it managed. In this context, it collected participants’ personal data, including names, postal addresses, email addresses and telephone numbers. It then transferred this data to commercial partners for marketing purposes in exchange for payment. The DPA, carried out an on-site inspection at the controller’s premises and later initiated sanction proceedings. The DPA found that the controller’s consent mechanisms did not allow users to give free, specific, informed and unambiguous consent to the transfer of their data to partners for marketing purposes. The controller had used different versions of consent forms. One version displayed a prominent “I agree” button, while the option to continue without receiving partner offers was only available through a less visible link in smaller text. Another version included two buttons, “I agree” and “I decline”, but the visual presentation continued to emphasise consent. The controller later proposed a new form with two similar buttons, “I agree” and “Next step”. The DPA imposed a €75,000 administrative fine for breaches of GDPR Articles 6 and 30. It also ordered the controller, under a daily penalty of €1,000, to implement a compliant form collecting valid consent for the transfer of data to partners. The controller appealed the decision before the Court. The Court partly upheld the appeal. First, the Court rejected the controller’s procedural arguments regarding the DPA’s inspection and the referral to the restricted committee. It held that the competent public prosecutor had been informed in advance of the inspection and that the restricted committee had been validly seized and convened. Second, the Court found that the controller’s rights of defence had been breached in relation to one of the violations. The DPA’s report had alleged that the controller had engaged in unfair processing under GDPR Article 5 because it led users to believe that all transfers were based on consent, while some data was transferred on the basis of legitimate interest and without an option to object. However, the final decision requalified this issue as a breach of GDPR Article 6 for failure to obtain prior consent. Since this specific legal ground had not been included in the report communicated to the controller, the controller had not been able to comment on it. The Court therefore annulled this part of the DPA’s decision. Third, the Court confirmed that the controller’s consent forms did not meet the requirements of the GDPR. It recalled that consent must be freely given, specific, informed and unambiguous, and that it requires a clear affirmative action by the data subject. Although the forms required a positive action, their design and wording were ambiguous. In particular, the “I agree” option was visually highlighted, while the alternative options were less clear or could be misunderstood by users. Therefore, the forms did not allow valid consent for the transfer of personal data to partners for commercial marketing. Fourth, the Court rejected the controller’s argument that the principle of legality of offences and penalties had been breached. It held that the GDPR rules on consent were sufficiently clear and foreseeable for a professional in the digital marketing sector. As a result, the Court reduced the administrative fine from €75,000 to €50,000, taking into account the annulment of one part of the DPA’s reasoning. However, it upheld the injunction requiring the controller to implement a GDPR-compliant consent form, subject to a daily penalty. The Court also ordered publication of its decision under the same conditions as the DPA’s decision and ordered the DPA to pay €2,000 to the controller for legal costs.