lagen.nu
C-317/25

Opinion of Advocate General Spielmann delivered on 17 September 2026

CELEX
62025CC0317
Datum
2026-09-17
Källa
eur-lex.europa.eu

Provisional text

OPINION OF ADVOCATE GENERAL

SPIELMANN

delivered on 17 September 2026 ( 1 )

Case C ‑ 317/25

Groupe Canal + SAS

v

Commission nationale de l’informatique et des libertés (CNIL),

other parties:

Premier ministre,

Syndicat professionnel Data et Marketing France (DMA France),

Association Alliance Digitale,

Syndicat Collectif pour les acteurs du marketing digital (CPA),

Association Le Groupement des éditeurs de contenus et services en ligne (GESTE)

(Request for a preliminary ruling from the Conseil d’État (Council of State, France))

( Reference for a preliminary ruling – Directive 2002/58/EC – Processing of personal data and protection of privacy in the electronic communications sector – Article 13 – Use of electronic mail for the purposes of direct marketing – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4, point 11 – Data subject’s consent – Article 12(1) – Transparency of information – Article 13(1) and Article 14(1) – Obligation of the controller to provide information – Data collected by a primary collector for the purposes of electronic direct marketing by its ‘partners’ – Data subject’s consent – Identification of the recipients of the data collected )

Introduction

1. The present request for a preliminary ruling has been made by the Conseil d’État (Council of State, France), in the context of an appeal brought by Groupe Canal + SAS against Decision No SAN-2023-015 of 12 October 2023 of the Commission nationale de l’informatique et des libertés (the French Data Protection Authority) (CNIL) (‘the CNIL decision’) ( 2 ) ordering it to pay a fine for carrying out direct marketing activities, within the meaning of Article 13 of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (Privacy and Electronic Communications Directive), ( 3 ) without having obtained the consent of the data subjects. When their personal data were collected by internet service providers (‘ISPs’), those individuals had consented to the transfer of their data, for the purposes of unsolicited commercial communications (spam), to ‘partners’ that were not identified at the time their consent was obtained.

2. The present case therefore provides the Court with an opportunity to clarify the conditions under which an operation involving the subsequent processing of personal data by a different controller may be based on the initial consent given at the time those data were collected.

Legal framework

European Union law

Directive 2002/58

3. Recital 40 of Directive 2002/58 establishes that ‘safeguards should be provided for subscribers against intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes, and e-mails, including SMS messages. These forms of unsolicited commercial communications may on the one hand be relatively easy and cheap to send and on the other may impose a burden and/or cost on the recipient. Moreover, in some cases their volume may also cause difficulties for electronic communications networks and terminal equipment. For such forms of unsolicited communications for direct marketing, it is justified to require that prior explicit consent of the recipients is obtained before such communications are addressed to them. The single market requires a harmonised approach to ensure simple, Community-wide rules for businesses and users’.

4. Under point (f) of the second subparagraph of Article 2 of that directive, ‘“consent” by a user or subscriber corresponds to the “data subject’s consent” in Directive 95/46/EC [( 4 )]’.

5. Article 13 of that directive, entitled ‘Unsolicited communications’, provides:

‘1. The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent.

2. Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use.

…’

The GDPR

6. Article 4, point 11, of the GDPR defines consent of the data subject as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.

7. Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, states:

‘1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes …’

…

8. Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:

‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

…’

9. Chapter III of the GDPR, which includes Articles 12 to 23, is entitled ‘Rights of the data subject’. Article 12 of that regulation, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, states, in paragraph 1:

‘The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.’

10. Article 13 of that regulation, entitled ‘Information to be provided where personal data are collected from the data subject’, provides:

‘1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

…

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

…

(e) the recipients or categories of recipients of the personal data, if any; …

…

3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where and in so far as the data subject already has the information.’

11. Article 14 of the GDPR, entitled ‘Information to be provided where personal data have not been obtained from the data subject’, provides:

‘1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

…

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

…

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

…

(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

…

(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

…

3. The controller shall provide the information referred to in paragraphs 1 and 2:

(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

5. Paragraphs 1 to 4 shall not apply where and in so far as:

(a) the data subject already has the information;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.’

French law

The Post and Electronic Communications Code

12. Article L. 34-5 of the Code des postes et des communications électroniques (Post and Electronic Communications Code), which transposes Article 13 of Directive 2002/58 into national law, in the version applicable to the main proceedings, ( 5 ) provides:

‘Direct marketing by means of an automated electronic communication system within the meaning of Article L. 32(6), fax machine or emails using the contact details of a natural person, subscriber or user, who has not expressed beforehand his or her consent to receive direct market research by those means is prohibited.

For the purposes of this article, consent means any freely given specific and informed indication of an individual’s wishes by which he or she signifies his or her agreement to his or her personal data being used for [the purposes of] direct marketing.

Direct marketing is defined as the sending of any message intended to promote, directly or indirectly, goods, services or the image of a person selling goods or providing services. For the purposes of this article, calls and messages intended to encourage the user or subscriber to call a premium-rate number or to send a premium-rate text message shall also be regarded as direct marketing.

However, direct marketing by email shall be permitted if the recipient’s contact details have been obtained from him or her, in accordance with the provisions of loi n o 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 of 6 January 1978 on data processing, data files and civil liberties), [( 6 )] in connection with a sale or the provision of services, provided that the direct marketing relates to similar products or services supplied by the same natural or legal person, and provided that the recipient is offered, expressly and unambiguously, the opportunity to object, free of charge (apart from any costs associated with sending the refusal) and in an easy manner, to the use of his or her contact details at the time they are collected and each time a marketing email is sent to him or her, if he or she has not refused such use from the outset.

…’

Law No 78-17

13. Article 4 of Law No 78-17 states, in essence, that personal data must be processed lawfully and fairly, must be collected for specified, explicit and legitimate purposes, and must not be further processed in a manner incompatible with those purposes. It should be adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed, and accurate.

The dispute in the main proceedings, the questions referred and the procedure before the Court of Justice

14. During 2021, Groupe Canal + commissioned on its own behalf electronic direct marketing campaigns targeting approximately 3.9 million people, whose personal data had previously been obtained from two ISPs. To enable that process, those ISPs had asked their subscribers to tick a box on a data collection form indicating their consent to the use of their personal data for direct marketing purposes by the ‘partners’ of those ISPs, although those partners were not identified either in the data collection form or in a list accessible via a hyperlink or by any other means.

15. Having received several complaints regarding direct marketing activities carried out electronically by Groupe Canal +, the CNIL conducted inspections at the company’s premises and, by a decision of 12 October 2023, the CNIL’s select panel found that the company had breached the obligations arising from Article L. 34-5 of the Post and Electronic Communications Code and Article 7(1) of the GDPR, in that it did not have the valid consent of the data subjects to carry out those activities. Consequently, given that Groupe Canal + had failed to comply with the obligation to obtain such consent, the CNIL imposed an administrative fine of EUR 600 000 on the company.

16. By an application dated 15 December 2023, Groupe Canal + brought the matter before the Conseil d’État (Council of State, France), which is the referring court, seeking the annulment of the CNIL’s decision and its amendment with a view to reducing the amount of the administrative fine imposed on it. Before the referring court, Groupe Canal + argues that the consent of the data subjects, obtained by the ISPs, was sufficiently informed for them to be able to receive electronic direct marketing on its behalf, in so far as those individuals had already given their consent to the use of their personal data by the partners of the ISPs.

17. The referring court is considering whether the consent obtained by the ISPs, as the primary collectors, for the use of the data subjects’ personal data for the purposes of direct marketing by the partners of those providers, enables Groupe Canal + to carry out its direct marketing activities. In particular, it seeks to ascertain whether Groupe Canal +, which was not specifically identified as one of the partners of the ISPs, with its identity therefore being unknown to the data subjects, was or was not required to obtain fresh, specific consent from them before carrying out its direct marketing activities. Furthermore, while the consent obtained by the ISPs may be regarded as informed consent within the meaning of the GDPR and Directive 2002/58, the referring court questions the degree of precision of the concept of a ‘category’ of recipients.

18. In those circumstances, the Conseil d’État (Council of State) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Must [point 11 of Article 4] of the GDPR, read in conjunction with Articles 13 and 14 of the GDPR and Article 13 of Directive [2002/58] of 12 July 2002, be interpreted as meaning that the data subject’s consent given to a primary collector for his or her data to be used by a category of recipients, such as, in the present case, the “partners” of ISPs (internet service providers), may be regarded as free, specific, informed and unambiguous consent enabling any person belonging to that category to engage in electronic direct marketing without having to seek consent again, or does the combination of those provisions imply, in such a case, that any recipient of the personal data collected whose identity was not known to the data subject at the time consent was given to the primary collector must obtain that person’s consent before being able to conduct direct marketing on him or her in its capacity as the new controller?

(2) If it is to be assumed that the consent given by the data subject to a primary collector to his or her data being used by a category of recipients for electronic direct marketing may be regarded as informed consent within the meaning of the provisions cited above, is the degree of precision of the concept of “category” of recipients significant or may it, as in the present case, merely refer to any “partner” of the primary collector?’

19. Written submissions were made by Groupe Canal +, and by the European Commission and the French, Spanish and Italian Governments. At the public hearing held on 2 July 2026, Groupe Canal +, the trade association Data and Marketing France, the Commission and the French and Spanish Governments presented their oral submissions.

Analysis

The first question referred

20. The referring court asks whether the consent given by the subscribers of ISPs when their personal data were collected allowed Groupe Canal + to use those data for the purposes of direct marketing to them without obtaining further consent.

21. In essence, Groupe Canal + argues that it was not required to obtain fresh consent in order to carry out electronic direct marketing activities targeting the data subjects. Conversely, the other interested parties consider that the consent obtained by the ISPs, based solely on information regarding the ‘categories of recipients’ to which data collected during an initial processing operation are transmitted, is not sufficient to demonstrate the existence of the consent required for the second processing operation, which consists of electronic direct marketing activities carried out by Groupe Canal +.

22. After setting out the provisions applicable to the main proceedings, I will examine the scope of the consent given by the data subjects at the time their personal data were collected in order to determine whether that consent could constitute the legal basis for direct marketing by Groupe Canal +.

Review of the relevant provisions

– The requirement for consent within the meaning of Article 13(1) of Directive 2002/58

23. I would first like to point out that the main proceedings concern direct marketing activities carried out by Groupe Canal +. Article 13 of Directive 2002/58, entitled ‘Unsolicited communications’, is intended, in particular – as stated in recital 40 of that directive – to protect subscribers against any infringement of their privacy through unsolicited communications made for the purposes of direct marketing. As stated in Article 1(2) of that directive, read in conjunction with recital 173 of the GDPR, Directive 2002/58 acts as lex specialis , supplementing the GDPR ( lex generalis ). ( 7 ) Article 13 of Directive 2002/58 is therefore applicable to the dispute in the main proceedings, and the assessment of the lawfulness of the processing – consisting of the use by Groupe Canal + of the personal data in question – must therefore be carried out in the light of the conditions laid down in that directive.

24. I would also point out that Article 13(1) of that directive allows the use of various types of communication, namely automated calling systems without human intervention (automatic calling machines), facsimile machines, and electronic mail, for the purposes of direct marketing, on the condition that they target subscribers who have given their prior consent. In order to apply that provision, it is necessary therefore to ascertain, in the first place, whether the type of communication used for those direct marketing purposes is amongst those covered by that provision; in the second place, whether such a communication has the purpose of direct marketing, namely that it is for commercial purposes and is intended directly and individually for a consumer; and, in the third place, whether the requirement to obtain prior consent from the user has been complied with. ( 8 )

25. In the present case, it is apparent from the request for a preliminary ruling that the first two conditions are met. Indeed, the referring court specifically refers to ‘electronic direct marketing’ activities carried out in relation to the data subjects, who are prospective customers of Groupe Canal +.

26. On the other hand, the core issue is whether the data subjects, the recipients of unsolicited communications for the purposes of commercial marketing, have given their prior consent.

27. There is no dispute that consent is required as the basis for further processing for direct marketing purposes. In that regard, I would point out that the conditions for the exception to the requirement for consent laid down in Article 13(2) of Directive 2002/58 are not met in the main proceedings. ( 9 ) The issue at the heart of the dispute between the parties is whether, given that the identity of the controller responsible for the further processing for direct marketing purposes was not known, the consent given by subscribers at the time of the initial data collection was sufficient, or whether a second consent had to be given, which brings me to the concept of ‘informed consent’.

– Informed consent within the meaning of the GDPR

28. Consent within the meaning of Directive 2002/58, and in particular Article 13(1) thereof, must be understood as consent as provided for in the GDPR. Indeed, on the one hand, point (f) of the second subparagraph of Article 2 of that directive, read in the light of its recital 17, ( 10 ) defines the ‘consent’ of a user or subscriber as corresponding to the ‘data subject’s consent’ referred to in Directive 95/46; and, on the other hand, Article 94(2) of the GDPR provides that references to Directive 95/46, which has been repealed by the GDPR, are to be construed as references to the GDPR.

29. It follows from those provisions that consent must satisfy the requirements laid down in Article 4, point 11 of the GDPR, which is applicable ratione temporis to the main proceedings and which defines the ‘consent of the data subject’ as requiring a ‘freely given, specific, informed and unambiguous’ indication of the data subject’s wishes, in the form of a statement or of ‘a clear affirmative action’ signifying agreement to the processing of personal data relating to him or her. ( 11 )

30. In the case at hand, it is not contested that the consent given at the time of the initial collection was freely given, specific and unambiguous. The disagreement between the parties centres on whether the consent given by the data subjects was sufficiently informed to permit the processing of their data for direct marketing purposes.

31. I would point out that the requirement for ‘informed’ consent, within the meaning of Article 4, point 11, of the GDPR – which is necessary for data processing to be lawful – depends, among other things, on whether that person has, beforehand, been provided with the information – in the light of all the circumstances surrounding the processing of the data in question – to which he or she was entitled and which enables that person to make choices regarding the use of his or her data and to give consent, in a ‘self-determined’ manner, in full knowledge of the facts. ( 12 )

32. As laid down in Article 12 of the GDPR, which embodies the principle of transparency, the data controller must implement appropriate measures to provide all the information referred to in Articles 13 and 14 of that regulation. In that regard, the controller must provide the data subject with information regarding all the circumstances surrounding the processing of the data, in an intelligible and easily accessible form, using clear and plain language; the data subject must be informed not only of the type of data to be processed, but also of the duration and methods of such processing, the purposes for which it is carried out, and the identity of the controller. Such information must allow the data subject to easily understand the consequences of any consent he or she might give and ensure that the consent is given with full knowledge of the facts. ( 13 ) A cornerstone of the principle of transparency, the right to information guarantees transparency of all processing in the context of the GDPR. ( 14 )

33. Furthermore, as the Court has stated, the controller’s obligation to provide information to subjects of the processing of personal data is ‘the corollary of the right to information which is conferred on those data subjects by Articles 12 and 13 of the GDPR’. ( 15 )

34. The infringement of the data subjects’ right to be sufficiently informed of all the circumstances surrounding processing of personal data, in particular the identity of the controller, is therefore liable to preclude the expression of informed consent within the meaning of point 11 of Article 4 of the GDPR, which may render that treatment unlawful, within the meaning of Article 5(1) of that regulation. ( 16 ) The data subject’s right to information therefore contributes to the existence of consent capable of providing a basis for lawful data processing, and the identity of the data controller in question is, in that respect, a particularly essential element in informing that consent.

35. Furthermore, the obligations regarding the obtaining of consent and the provision of information designed to inform that consent rest with the data controller in question, and thus the person who ‘determines the purposes and means [of that] processing’. ( 17 )

36. In the context of the main proceedings, at the stage involving the collection of personal data by ISPs and the transfer of such data to their partners, Article 13 of the GDPR applies to ISPs in terms of information obligations, and allows only categories of recipients to be specified. ( 18 ) ISPs are therefore not required to specify the recipient of the data. Otherwise, the term ‘category of recipients’ would be rendered meaningless.

37. However, at the direct marketing stage, personal data collected indirectly by ISPs are used by Groupe Canal +, ( 19 ) and the information to be provided to data subjects at the present stage is the information required under Article 14 of the GDPR, which was adopted to address situations in which the data controller is not in direct contact with the data subject. ( 20 ) In such situations falling within the scope of Article 14 of the GDPR, as the Court has held, the controller collects the personal data from another source, with the result that the disclosure of the information referred to in that provision at the time when that information is obtained is, in practice, made difficult or even impossible. The indirect nature of such collection therefore justifies the latter provision providing for the possibility of ‘deferring the controller’s obligation to provide information’ which is the responsibility of the controller. ( 21 ) However, the general rule is that the controller that has obtained personal data indirectly must provide the information within a reasonable period after obtaining those data, but at the latest within one month, having regard to the specific circumstances in which those data are processed. ( 22 ) Furthermore, if those same data are to be used for communication with the data subject, the controller must provide the information at the latest at the time of the first communication to that data subject. ( 23 )

38. It is against that background that the question arises as to whether, in the context of the main proceedings, the consent obtained by the ISPs could constitute the legal basis for the further direct marketing processing carried out by Groupe Canal + without the need to obtain further consent. That in turn now raises the question of the scope of the consent obtained by the ISPs.

The scope of the consent given in the present case

39. It can be argued that when a subscriber to an ISP ticks a box on a form giving his or her consent to the use of his or her personal data for direct marketing purposes by the ‘partners’ of that ISP, that constitutes consent to the transfer of that subscriber’s data to those partners, with a view to that individual subsequently being the subject of direct marketing communications for commercial purposes, directed specifically and individually at him or her. ( 24 ) In my view, that results in consent to the transfer of data for the purpose of direct marketing, as stated at the time the personal data were collected.

40. However, as the French Government (among others) has pointed out, such consent does not necessarily mean that the data subjects have consented to direct marketing activities being carried out by any person whatsoever.

41. However, like the Commission and the governments concerned, I take the view that, in order to provide a legal basis for such direct marketing, that consent must, in particular, relate to the identity of the data controller responsible for processing for direct marketing purposes. ( 25 ) Until that is the case, processing for direct marketing purposes may not commence without new, duly informed consent regarding the identity of the controller responsible for that processing.

42. I believe that that interpretation stems from the wording of the relevant provisions, the context in which they are set, and the objectives pursued by the legislation of which they form part. ( 26 )

43. In the first place, Article 13(1) of Directive 2002/58 requires prior consent that, at the direct marketing stage, must be assessed in the light of the requirements of Article 14 of the GDPR if the data have been collected indirectly. Under paragraph 1(a) of that article, that implies knowledge of the identity of the controller responsible for that marketing. ( 27 ) Article 14(3)(b) of the GDPR also establishes that, if the personal data are to be used for communication with the data subject, the controller must provide the information required, including the identity of the controller, at the latest at the time of the first communication to that data subject.

44. In the second place, the context surrounding those provisions corroborates that interpretation.

45. First, it is clear from recital 42 of the GDPR that ‘for consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended’.

46. Admittedly, the Court has recognised, in certain specific data processing chains, that it is not necessary to obtain consent on a repeated basis. That is the case in particular where the purpose of the further processing operations is the same. ( 28 ) However, that specific case-law approach is limited to the consent referred to in Article 12 of Directive 2002/58. Moreover, the Court has been careful to point out that, as stated in recital 39 of that directive, if the party collecting the data from the subscriber or any third party to whom the data have been transmitted wishes to use the data for an additional purpose other than the publication of a public directory, the renewed consent of the subscriber is to be obtained either by the initial party collecting the data or by the third party to whom the data have been transmitted. ( 29 )

47. I therefore consider that Groupe Canal + cannot validly rely on that case-law, which is not applicable to the main proceedings. On the contrary, such case-law tends to support the interpretation that, in the circumstances of the main proceedings, new consent is required to provide a legal basis for processing for direct marketing purposes where personal data are used for purposes other than those for which they were collected.

48. Second, the principles of transparency and fairness in data processing, as laid down in Article 5(1)(a) of the GDPR, read in the light of recitals 60 and 61 of that regulation, ( 30 ) justify, in my view, the position that data subjects be kept informed as soon as possible of any changes affecting the category of recipients of their data. The provision of such information therefore ensures that the data subject does not ‘miss’ any changes regarding the recipients of his or her personal data, and allows that subject a reasonable period of time to assess the nature and impact of the change and, where appropriate, to exercise his or her rights under the GDPR in relation to the change (for example, by withdrawing consent or objecting to the processing). ( 31 )

49. I would add that the unsubscribe link, which allows consent to be withdrawn upon receipt of the first communication – to which Groupe Canal + referred at the hearing – forms part of the exercise of those rights and remains necessary for that purpose, in particular pursuant to Article 13(4) of Directive 2002/58, but does not retrospectively correct an absence of prior consent regarding the identity of the data controller for processing for direct marketing purposes, which is specifically intended to render that processing lawful before it takes place.

50. Furthermore, those updates to information, which are intended to inform the consent of the data subjects, should take place without any active request on their part based on their right of access as provided for in Article 15 of the GDPR. On that point, the argument put forward by Groupe Canal + concerning the distinction between, on the one hand, the information requirements laid down in Articles 13 and 14 of the GDPR and, on the other hand, the functional role of the right of access provided for in Article 15 of the GDPR ( 32 ) does not, in my view, mitigate the obligation to provide prior information in the circumstances of the present case. The right of access responds to a specific request from the data subject, ( 33 ) whereas the information provided under Articles 13 and 14 of the GDPR, which requires active action on the part of the controller, is directed at all data subjects and is of a more general nature. That being said, irrespective of whether data subjects have a right of access that they may or may not choose to exercise, insufficient information provided under Articles 13 or 14 of the GDPR results only in consent of a limited scope, which is not, in itself, sufficient to permit the processing of personal data for marketing purposes without the identity of the data controller being known.

51. Third, I note that the exceptions to the obligation to provide the information set out in the legislation – in particular, the identity of the data controller – are exhaustively listed in Article 14(5) of the GDPR.

52. Those exceptions are not applicable in the present case.

53. In particular, the exception referred to in Article 14(5)(a) of the GDPR, which applies where data subjects already have the information in question, does not apply, given that the identity of the controller carrying out the direct marketing activities has, by definition, not yet been disclosed.

54. Similarly, I do not consider that providing information regarding the identity of the controller responsible for direct marketing activities would require a disproportionate effort within the meaning of Article 14(5)(b) of the GDPR. Indeed, as suggested by certain interested parties, Groupe Canal + could, under the terms of a contract, entrust ISPs with the task of obtaining the necessary consent for processing for direct marketing purposes, either by specifying the identity of the recipients or, if they are not yet known at the time when the data are collected, for example by maintaining an up-to-date list of any substantial changes relating to the processing of personal data or concerning information previously provided. ( 34 ) Failing that, Groupe Canal + could still obtain consent before carrying out the direct marketing itself, and thus no later than at the time of the first communication to the data subject. That scenario is, moreover, covered by Article 14(3)(b) of the GDPR.

55. In the third place, the relevant provisions should be interpreted in a manner consistent with the objectives pursued by Directive 2002/58, as set out in recitals 2 and 40 of that text, which seek, inter alia, to ensure full respect for the rights set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and, to that end, to provide safeguards for subscribers against any intrusion of their privacy by unsolicited communications for direct marketing purposes.

56. In that regard, as stated in recital 40 of Directive 2002/58, communications for the purposes of direct marketing sent by email ‘may on the one hand be relatively easy and cheap to send’ while imposing a burden and/or cost on the recipient and in some cases volume-related difficulties for electronic communications networks and terminal equipment. It is therefore particularly justified to require the data controller responsible for processing for direct marketing purposes (the sender of direct marketing communications) to have obtained the prior consent of the prospective customer (the recipient of the direct marketing communications) before sending them.

57. Given that marketing via email or other means of direct and individual communication constitutes an intrusion into privacy, ( 35 ) I consider that the requirement for prior consent, which must be informed as to the identity of the controller responsible for the direct marketing processing, is all the more essential prior to such marketing. If such consent is not obtained, the practical effect of Article 13(1) of Directive 2002/58 would be undermined and that condition required for processing intended for direct marketing purposes to be lawful would be circumvented.

58. Furthermore, given the significant issues surrounding the secondary use of personal data, particularly by data brokers, ( 36 ) I am not in favour of an interpretation of the legislation on consent that would weaken the protection of personal data in that regard.

59. In light of those considerations, I do not find the argument put forward by Groupe Canal + regarding ‘consent fatigue’ ( 37 ) persuasive and, moreover, it cannot exempt data controllers (whether ISPs when data are transferred or Groupe Canal + during the initial direct marketing campaign) from their obligations regarding prior, informed consent.

60. It follows that, contrary to what Groupe Canal + is asserting, I consider that, because the consent given by the data subjects at the time the data are initially collected does not relate to the identity of the data controller responsible for processing for direct marketing purposes, its scope is limited and does not permit Groupe Canal + to carry out direct marketing activities without obtaining fresh consent, and that must be obtained no later than at the time of the first communication to the data subjects.

61. I therefore take the view that the answer to the first question referred is that Article 4, point 11, of the GDPR, read in conjunction with Articles 13 and 14 of that regulation and with Article 13 of Directive 2002/58, must be interpreted as meaning that the data subject’s consent given to a primary collector for his or her data to be used by a category of recipients who are designated as the primary collector’s ‘partners’, but whose identity was not known to the data subject at the time consent was given to the primary collector, cannot be regarded as informed consent permitting any person belonging to that category of recipients to carry out commercial marketing activities by electronic means without first obtaining fresh consent from the data subjects before carrying out such commercial marketing activities in relation to them.

62. Consequently, there is no need to answer the second question referred. I will therefore consider that question below in the alternative.

The second question referred

63. If the Court does not agree with my proposed answer to the first question, I can see two possible approaches for answering the second question, concerning the degree of precision of the concept of a ‘category’ of recipients and its link to the requirement that consent be sufficiently informed.

64. The first approach would be to consider that there is no link between, on the one hand, whether consent is sufficiently informed and, on the other hand, the degree of precision of the concept of a ‘category’ of recipients. In that scenario, the identity of the data controller responsible for direct marketing activities does not appear to be a condition for the validity of consent to be subject to such processing for marketing purposes. Consequently, consent given by the data subject to a primary collector for his or her data to be used by a category of recipients for the purposes of electronic direct marketing could be regarded as sufficiently informed consent, regardless of the degree of precision of the concept of a ‘category’ of recipients. It could therefore be argued that the identity of the data controller responsible for processing for direct marketing purposes should only be disclosed for the purposes of exercising rights such as the right of access to personal data, the right to rectification or erasure of such data, or the right to object to processing. Consent would then be regarded as sufficiently informed, regardless of whether the category of recipients specified is precise. In the present case, Groupe Canal + could therefore carry out the direct marketing campaign without the need for further consent, regardless of how precisely the category of recipients was specified at the time of the initial data collection.

65. The second approach, which I would prefer, could suggest that there is a link between, on the one hand, whether consent is sufficiently informed and, on the other hand, the degree of precision of the concept of a ‘category’ of recipients. Accordingly, even in the absence of information regarding the specific identity of the data controller responsible for the direct marketing activity, it would still be necessary to be able to identify that party in order to carry out direct marketing without obtaining fresh consent. The degree of precision of the concept of ‘category of recipients’ could therefore be significant.

66. Consequently, the ‘category’ of recipients should be specified by the primary collector so that, given the context and circumstances at the time the data were collected, the data subject can reasonably expect that his or her personal data will be used for direct marketing purposes by the person contacting him or her. In other words, the data subject should not be surprised by direct marketing from Groupe Canal + and should be aware that he or she consented to that marketing at the time the personal data were collected by the ISP, given, for example, the specific nature of the category of recipients mentioned or the context of the data collection and the activity of the primary collector (in the present case, the ISPs). ( 38 )

67. However, in the case at hand, the concept of the ‘partners’ of the ISPs remains, as a ‘category’ of recipients, a very vague concept in the context of the collection of personal data by ISPs. Contrary to the assertions made by Groupe Canal +, I consider that the use of the term ‘partner’, even when viewed in the context of the purpose of electronic direct marketing, is not sufficient to inform the data subject to such an extent that he or she can be deemed to have given informed consent to be contacted by Groupe Canal +. Even assuming that the subscribers of the ISPs might have some idea of what Groupe Canal + refers to as the provider’s ‘commercial ecosystem’, I do not believe that clarifies the concept of a ‘partner’, and nor does it identify what being a ‘partner’ of that provider might entail in terms of the goods or services concerned. ( 39 ) The only indication is that it is an entity with a contractual and commercial relationship with the ISP, which constitutes a category that, while certainly not infinite, is nonetheless undefined. Indeed, by definition, the transfer of data from the ISP to the recipient usually involves such a relationship.

68. Furthermore, in the context of the main proceedings, that concept of ‘partner’ seems to me to be so vague that, when giving their consent at the time when the data are collected, the ISPs’ subscribers should, on the contrary, expect to be informed more precisely as to the identity of that partner when the time comes, and thus at the time when their data are transferred to that partner and, at the latest, prior to any direct marketing activities. I would also note that, according to the Article 29 Working Party, where only ‘categories of recipients’ are disclosed, the information should be as specific as possible and should indicate, for example, the type of recipient based on the activities it carries out, the industry, sector and sub-sector, as well as the location of the recipients in question. ( 40 )

69. It follows, in my view, that while it may be accepted that consent given in the presence of a ‘category of recipients’ may legally form the basis for direct marketing by one of those recipients without that recipient being identified, it should nevertheless be reasonably possible to identify that recipient, when the time comes, as the recipient of the ISPs responsible for primary collection. ( 41 ) Consequently, the greater the lack of precision regarding those categories of recipients at the initial data collection stage, the less likely it is that that will result in consent that could form the legal basis for the use of the personal data collected for the purposes of direct marketing by another controller.

70. In the circumstances of the main proceedings, I consider that the concept of a ‘partner’ of the ISPs responsible for primary collection cannot generate the ‘chain of consents’ relied upon by Groupe Canal +. Applying that second approach, it would therefore still be necessary to obtain fresh consent allowing the recipient of the data to be identified before the personal data in question can be used for direct marketing purposes.

Conclusion

71. In the light of all the foregoing, I propose that the Court of Justice should, first, declare that there is no need to answer the second question raised by the Conseil d’État (Council of State, France) and, second, answer the first question referred as follows:

Article 4, point 11 of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, in conjunction with Articles 13 and 14 of that regulation and Article 13 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Privacy and Electronic Communications Directive),

must be interpreted as meaning that the data subject’s consent given to a primary collector for his or her data to be used by a category of recipients who are designated as the primary collector’s ‘partners’, but whose identity was not known to the data subject at the time consent was given to the primary collector, cannot be regarded as informed consent permitting any person belonging to that category of recipients to carry out commercial marketing activities by electronic means without first obtaining fresh consent from the data subjects before carrying out such commercial marketing activities in relation to them.

1 Original language: French.

2 Available at: https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048222771.

3 Directive of the European Parliament and of the Council of 12 July 2002 (OJ 2002 L 201, p. 37). The proposal for an ‘ePrivacy’ regulation has been withdrawn (see annexes to the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions. Commission work programme 2025. Moving forward together: A Bolder, Simpler, Faster Union (COM(2025) 45 final), p. 26, No 29).

4 Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). This directive has been replaced by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ 2016 L 119, p. 1; the ‘GDPR’). Article 94 of the GDPR, entitled ‘Repeal of Directive 95/46/EC’, provides, in paragraph 2 thereof, that references to the repealed directive shall be construed as references to the GDPR.

5 As amended by Article 8 of Law No 2020-901 of 24 July 2020 (JORF of 25 July 2020, No 181).

6 JORF of 7 January 1978, No 6 (‘Law No 78-17’).

7 See judgment of 13 November 2025, Inteligo Media (C‑654/23, EU:C:2025:871, paragraphs 66 to 68). See also European Data Protection Board (EDPB), Opinion 5/2019 of 12 March 2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities, p. 12 et seq., available at: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-52019-on-the-interplay-between-the-eprivacy-directive_en.

8 See judgment of 25 November 2021, StWL Städtische Werke Lauf a.d. Pegnitz (C‑102/20, EU:C:2021:954, paragraph 37). With regard to the definition of the term ‘electronic mail’, which is ‘broad and intended to be technology neutral’, see Article 29 Working Party – Opinion 5/2004 of 27 February 2004 on unsolicited communications for marketing purposes under Article 13 of Directive 2002/58/EC, WP 90, paragraph 3.1, available at: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2004/wp90_en.pdf.

9 The exemption from the rule on prior consent is justified by the fact that, within the context of an existing customer-supplier relationship, it is reasonable to allow a company that, in accordance with the GDPR, has obtained its customers’ electronic contact details, to use those details – but only that company, and solely for the purpose of offering customers similar products or services (see recital 41 of Directive 2002/58). However, this is not the case in the main proceedings, since the direct marketing activities are not carried out by the ISPs that initially collect the data with a view to offering similar products or services. The exemption from the requirement for consent, as laid down in Article 13(2) of that directive, is therefore not applicable.

10 That recital states that, for the purposes of this directive, consent of a user or subscriber, regardless of whether the latter is a natural or a legal person, should have the same meaning as the data subject’s consent as defined and further specified in Directive 95/46.

11 This provision of the GDPR could therefore be regarded as more stringent than that laid down in Directive 95/46, Article 2(h) of which defined the term ‘the data subject’s consent’ as meaning ‘any freely given specific and informed indication of his [or her] wishes by which the data subject signifies his [or her] agreement to personal data relating to him [or her] being processed’ (see judgment of 1 October 2019, Planet49 (C‑673/17, EU:C:2019:801, paragraph 61). See also, EDPB, Guidelines 05/2020 of 4 May 2020 on consent under Regulation 2016/679, version 1.1, paragraph 1, available at: https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en.

12 See judgments of 11 July 2024, Meta Platforms Ireland (Representative action) (C‑757/22, ‘the judgment in Meta Platforms Ireland ’, EU:C:2024:598, paragraph 60), and, by analogy, of 4 September 2025, EDPS v SRB (Concept of personal data) (C‑413/23 P, EU:C:2025:645, paragraph 106).

13 See, to that effect, judgment of 11 November 2020, Orange Romania (C‑61/19, EU:C:2020:901 paragraph 40), and the judgment in Meta Platforms Ireland (paragraphs 55, 56, 59 and 60). On the close link between data protection and transparency, as emphasised in Article 12 of the GDPR, see Bygrave, L.A., and Tosoni, L., ‘Article 4(11). Consent’, in Kuner, C., Bygrave, L.A., Docksey, C., and Drechsler, L. (eds.), The EU General Data Protection Regulation (GDPR). A Commentary , Oxford University Press, Oxford, 2020, p. 184. See also Tambou, O., Manuel de droit européen de la protection des données à caractère personnel , Bruylant, Brussels, 2020, p. 129, No 141 et seq., specifically p. 134, No 144, and Dix, A., ‘Art. 12. Transparent information, communication and modalities for the exercise of the rights of the data subject’, in General Data Protection Regulation. Article-by-Article Commentary , Nomos, Baden-Baden, 2023, pp. 434 to 447.

14 See the Opinion of Advocate General Cruz Villalón in Bara and Others (C‑201/14, EU:C:2015:461, point 74) and the Opinion of Advocate General Medina in Storstockholms Lokaltrafik (C‑422/24, EU:C:2025:623, point 1).

15 See the judgment in Meta Platforms Ireland (paragraph 58).

16 See the judgment in Meta Platforms Ireland (paragraph 59).

17 It is defined as such in point 7 of Article 4 of the GDPR. See also, with regard to joint responsibility, judgment of 29 July 2019, Fashion ID (C‑40/17, EU:C:2019:629, paragraph 106).

18 At this stage, it is not always possible to identify the recipient, and the concept of a ‘category of recipients’ makes it possible to obtain consent on a broader basis.

19 The question of Groupe Canal +’s subcontractors that carry out those direct marketing activities on its behalf is not at issue here.

20 See judgment of 18 December 2025, Storstockholms Lokaltrafik (C‑422/24, ‘the judgment in Storstockholms Lokaltrafik ’, EU:C:2025:980, paragraph 39). See also, on the scope of Article 14 of the GDPR, judgment of 28 November 2024, Másdi (C‑169/23, EU:C:2024:988, paragraph 55).

21 See the judgment in Storstockholms Lokaltrafik (paragraph 39).

22 See Article 14(3)(a) of the GDPR. See also Article 29 Working Party – Guidelines on transparency under Regulation 2016/679, 11 April 2018, WP 260, rev. 01, paragraph 28 (‘Guidelines on transparency’), available at: https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en.

23 See Article 14(3)(b) of the GDPR.

24 See, on the concept of ‘direct marketing’, judgment of 25 November 2021, StWL Städtische Werke Lauf a.d. Pegnitz (C‑102/20, EU:C:2021:954, paragraph 47). See also, regarding the broad nature of the concept of ‘direct marketing’, Article 29 Working Party – Opinion 5/2004 of 27 February 2004 on unsolicited communications for marketing purposes under Article 13 of Directive 2002/58/EC, WP 90, paragraph 3.3.

25 See EDPB, Guidelines 05/2020 of 4 May 2020 on consent under Regulation 2016/679, version 1.1, paragraph 65, according to which ‘where the consent sought is to be relied upon by multiple (joint) controllers or if the data [are] to be transferred to or processed by other controllers who wish to rely on the original consent, these organisations should all be named’.

26 See, regarding this method of interpretation by the Court, in particular the judgment in Storstockholms Lokaltrafik (paragraph 28 and the case-law cited).

27 See, on this point, references made in points 31 to 35 of the present Opinion.

28 See judgments of 5 May 2011, Deutsche Telekom (C‑543/09, EU:C:2011:279, paragraphs 64 to 66), and of 27 October 2022, Proximus (public electronic directories) (C‑129/21, EU:C:2022:833, paragraphs 48 to 50).

29 See judgment of 27 October 2022, Proximus (public electronic directories) (C‑129/21, EU:C:2022:833, paragraph 50).

30 Recital 60 of the GDPR establishes in particular that the principles of fair and transparent processing ‘require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed’. Recital 61 of that regulation states in particular that ‘the information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case. Where personal data can be legitimately disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient . Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information’ (emphasis added).

31 See, by analogy, judgment of 1 October 2015, Bara and Others (C‑201/14, EU:C:2015:638, paragraph 34), in which the Court held that the requirement of fair processing of personal data requires, for example, a public administrative body to inform the data subjects of the transfer of those data to another public administrative body ‘for the purpose of their processing by the latter in its capacity as recipient of those data’ (emphasis added). See also paragraph 30 of the guidelines on transparency.

32 Article 15 of the GDPR does, in fact, play a ‘functional role’ and enables the data subject to exercise other rights laid down in the GDPR (see the Opinion of Advocate General Pitruzzella in Österreichische Post (Information regarding the recipients of personal data) (C‑154/21, EU:C:2022:452, point 33); see, also to that effect, judgments of 12 January 2023, Österreichische Post (Information regarding the recipients of personal data) (C‑154/21, EU:C:2023:3, paragraphs 38 and 39), and of 22 June 2023, Pankki S (C‑579/21, EU:C:2023:501, paragraph 58)).

33 Some authors have thus referred to ‘passive’ transparency on the part of the controller in the context of Article 15 of the GDPR, in that the responsibility for making the request lies with the data subject (see Zanfir-Fortuna, G., ‘Article 15. Right of access by the data subject’, in Kuner, C., Bygrave, L.A., Docksey, C., and Drechsler, L. (eds.), The EU General Data Protection Regulation (GDPR). A Commentary , Oxford University Press, Oxford, 2020, pp. 449 to 467). The right to information is ‘at the heart of the protection mechanism’, since the data subject cannot exercise his or her rights (and in particular the right of access under Article 15 of the GDPR) if he or she does not know whether his or her personal data are being processed (see Castets-Renard, C., ‘Titre 1 – Protection des données personnelles’, in Droit du marché unique numérique et intelligence artificielle , Bruylant, Brussels, 2020, 1st ed., pp. 221 to 300, specifically p. 270, No 341).

34 The CNIL’s decision also refers to this possibility in paragraph 27, where it mentions an exhaustive and up-to-date list ‘made available to individuals at the time their consent is obtained, for example directly on the data collection form or, if the list is too long, via a hyperlink to that list and the privacy policies of service providers and suppliers’.

35 See, to that effect, the Opinion of Advocate General Richard de la Tour in StWL Städtische Werke Lauf a.d. Pegnitz (C‑102/20, EU:C:2021:518, point 57).

36 See, in particular, Ruschemeier, H., ‘Data Brokers and European Digital Legislation’, EDPL , Vol. 9, No 1, 2023, pp. 27 to 38.

37 This refers to user fatigue, whereby, faced with too many requests, users end up giving their consent automatically without thinking, or, conversely, decide not to continue using the site. See, on this point in particular, the Commission’s ‘cookie pledge’ initiative, which aims, among other things, to reduce the need for consumers to constantly accept or reject cookies and other trackers, available at: https://commission.europa.eu/topics/consumers/consumer-rights-and-complaints/enforcement-consumer-protection/cookie-pledge_en.

38 I am drawing here on paragraph 49 of the Council of Europe’s explanatory report on the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 10 October 2018, known as ‘Convention 108+’, of 18 May 2018, concerning the fact that, in order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, ‘after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use ; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations’ (emphasis added) (available at: https://rm.coe.int/16808ac91b).

39 The complaints that led to the main proceedings are proof of this.

40 See, on this point, the guidelines on transparency, in particular the table in the annex.

41 The comparison made by Groupe Canal + between the internet user and the average reasonably attentive and well-informed European consumer could prove to be relevant (see, to that effect, the Opinion of Advocate General Szpunar in Planet49 (C‑673/17, EU:C:2019:246, point 113); see also, on the interplay between the protection of personal data and consumer law, the Opinion of Advocate General Richard de la Tour in Meta Platforms Ireland (C‑319/20, EU:C:2021:979, points 80 and 81)), with particular emphasis on the high level of consumer protection vis-à-vis the trader.