CJEU to Clarify Consent Under GDPR and ePrivacy Directive
The Court of Justice of the European Union (CJEU) will soon address a case involving a preliminary ruling request from France’s Conseil d’État. The case concerns the interpretation of consent under Article 4(11) of the General Data Protection Regulation (GDPR), in connection with Articles 13 and 14 of the GDPR and Article 13 of the ePrivacy Directive. The focus is on direct marketing activities carried out by third parties, specifically related to Groupe Canal+ (Case C-317/25).
The dispute arises from a conflict between Groupe Canal+, a pay-TV broadcaster, and the French data protection authority, Commission nationale de l’informatique et des libertés (CNIL). Several organizations representing the digital marketing sector are also involved. The key issue is whether consent given by a user to an initial data collector, such as an internet service provider, for the use of their data by a broad category of recipients, like the provider’s “partners,” is enough to permit those third parties to send electronic marketing communications.
The Conseil d’État seeks clarity on whether such consent can be considered valid for all entities within that category or whether each third party, whose identity was unknown to the user at the time of consent, must obtain fresh consent before processing the personal data. This raises questions about the level of specificity required in defining the category of recipients to meet the GDPR’s standards for informed consent.
Furthermore, the court is asked to clarify whether a general reference to “partners” of the original data collector satisfies the requirement for informed consent under both the GDPR and the ePrivacy Directive. The ruling will have significant implications for how businesses manage consent for data sharing in direct marketing, potentially affecting the practices of many companies operating within the European Union.
