‘Partner’ isn’t enough: new hurdles for advertising consent | HÄRTING Rechtsanwälte

Anyone who consents to their data being used for advertising by ‘partners’ must, it seems, also know who these partners actually are. In Case C-317/25 – Groupe Canal +, Advocate General Dean Spielmann proposes a correspondingly strict approach to the ECJ: General consent granted to unspecified ‘partners’ should not, in principle, legitimise electronic direct marketing. For companies that obtain leads, customer data or marketing contacts from third parties, the ruling could have significant practical consequences.

25. September 2026

Millions of advertising contacts and a supposedly simple consent process

The proceedings stem from electronic direct marketing campaigns run by Groupe Canal+ in 2021. Around 3.9 million people were targeted. The personal data used was sourced from two internet service providers. Their customers had previously consented to the use of their data for direct marketing by the providers’ ‘partners’. However, the identities of the companies behind these ‘partners’ were not disclosed, either in the consent form, via an accessible list of partners, or by any other means.

Following complaints, the French data protection authority, the CNIL, investigated the processing and, in 2023, imposed a fine totalling 600,000 euros on Groupe Canal+. The sanction, however, related to several breaches of the GDPR and French telecommunications law identified by the CNIL; the issue of consent to advertising, which was heard before the CJEU, forms only part of this complex matter.

Groupe Canal + challenged the decision before the French Conseil d’État. The Conseil d’État ultimately referred the question to the CJEU as to whether consent given to the original data controller in favour of an abstract category of recipients, such as ‘partners’, can be sufficient to allow a subsequent data recipient to send its own electronic direct marketing.

When is consent to advertising truly ‘informed’?

Article 13(1) of the ePrivacy Directive generally requires prior consent for electronic direct marketing. The form that this consent must take is governed by the requirements of the GDPR. Article 4(11) of the GDPR requires a voluntary expression of will, given for the specific case, in an informed manner and unambiguously.

Advocate General Spielmann focuses precisely on the characteristic of informed consent.

In his view, the data subject must be able to identify the controller who wishes to use the data for the specific direct marketing purpose. The Advocate General bases this view in particular on the information obligations under Articles 13 and 14 of the GDPR, as well as on Recital 42 of the GDPR. If a data record is not collected directly from the data subject, the new controller must, in accordance with Article 14 of the GDPR, provide information on, amongst other things, its identity, the purposes of the processing and the legal basis.

The ECJ has already emphasised in previous judgments that consent is only informed if the data subject can understand the circumstances of the data processing in a comprehensible and easily accessible form and recognise the consequences of their declaration.

‘Partners’ does not constitute a sufficiently defined group of persons

In the Advocate General’s view, whilst a person may consent to their data being transferred to ‘partners’ of the original provider, this does not automatically mean that they simultaneously accept electronic marketing from any company that may at some point fall under this definition of ‘partner’.

According to this line of reasoning, there is no sufficiently informed consent for the subsequent company’s own direct marketing as long as its identity was not known at the time of the original opt-in. Groupe Canal + could not, therefore, have simply relied on the consent given to the internet service providers.

The Advocate General therefore proposes to the Court of Justice that consent given in favour of unidentified ‘partners’ should not be regarded as a sufficient basis for their subsequent electronic direct marketing. If the identity of the controller carrying out the marketing is not known, a new, sufficiently informed consent should be required.

Of particular relevance to marketing practice: in Spielmann’s view, an unsubscribe link in the first advertising message cannot retrospectively remedy the lack of the previously required consent. An opt-out only takes effect after the advertising has commenced; however, the ePrivacy Directive generally requires prior consent.

Even a more precisely defined ‘partner category’ is unlikely to suffice without further ado

The Conseil d’État also raised the question of how precisely a recipient category would need to be described, should the mere designation of a category be deemed sufficient at all. According to the Advocate General’s primary legal opinion, the ECJ does not actually need to answer this second question: if the identity of the controller carrying out the subsequent advertising is required, a mere category would not suffice in any case.

However, Spielmann also comments on this scenario as a precaution. Should the Court of Justice deem categories to be sufficient in principle, they would have to be defined so precisely that the data subject could reasonably expect to be contacted by that particular undertaking. The term ‘partner’ is too vague for this purpose. A mere commercial or contractual relationship with the original data controller does not sufficiently define the group of potential advertisers.

What companies should now consider

The proceedings are particularly relevant for companies that do not work exclusively with contact data they have collected themselves, but instead obtain leads, prospect data or marketing lists from third-party companies. Existing processes should be reviewed to ensure that the consent actually covers the company that will subsequently carry out the advertising. According to the final recommendations, blanket clauses such as ‘advertising by our partners’, ‘selected companies’ or similarly vague wording entail considerable risks.

In practice, it is particularly advisable to fully document the origin of the data and the chain of consent, to make the identity of the intended advertising controllers transparent at the time of opt-in, and to be able to demonstrate what information was actually available to the data subject at the time consent was given. If further advertising partners are subsequently added to an existing system, it should not be assumed, without further verification, that an earlier consent also covers these companies.

Companies that purchase leads from third parties should also not rely solely on contractual assurances from the data supplier. They must be able to verify what specific consent has been given, how it was obtained and whether their own company is covered by it. Article 7(1) of the GDPR assigns the burden of proof for processing based on consent to the controller.

Is this also relevant for Swiss companies?

The proceedings directly concern the interpretation of European data protection and communications law. Nevertheless, the decision may be relevant to Swiss companies if their data processing falls within the territorial scope of the GDPR – for example, because they specifically offer goods or services to individuals in the EU. Article 3(2) of the GDPR may also extend the Regulation to controllers without an establishment in the EU.

However, it would not be appropriate to automatically apply the Opinion to purely Swiss advertising scenarios. These are governed by Swiss data protection and fair trading regulations. For cross-border marketing models, however, developments in Europe should be taken into account.

Conclusion: Anyone wishing to advertise should be named

The Opinion in Case C-317/25 primarily calls into question business models in which personal data is passed on via broadly defined ‘partner networks’ for the purposes of direct marketing. Should the ECJ follow the Advocate General’s opinion, the key message would be clear: consent to advertising by anonymous or only abstractly designated ‘partners’ is not sufficient if the company subsequently carrying out the advertising was not identifiable at the time consent was given. For lead generation, co-registration and other multi-stage marketing models, this would significantly increase the requirements regarding transparency, consent management and documentation.

However, this is not yet a ruling by the ECJ. Opinions are not binding on the Court. Case C-317/25 is still pending; the judgment will be delivered at a later date.