Commission nationale de l’informatique et des libertés (CNIL) – CJEU Judgment (European Union, 2026)

In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the