The Opinion of the Advocate General of the Court of Justice of the European Union of 17 September 2026 may materially define the limits of reliance by subsequent controllers on consent collected by an original commercial partner. The full text of the Opinion in our Judykatura database shows that, in electronic marketing, a general reference to “partners” does not entitle a subsequent controller to begin a campaign.

This article is available free of charge in full. Subscribe to our newsletter to receive new case notes and a discount code for your first subscription.

Advocate General Spielmann proposed that the Court of Justice should hold that consent given to an internet service provider for data to be used by its “partners” is not informed consent to electronic marketing conducted by every entity in that unidentified category. Before commencing such communication, the new controller should obtain fresh consent that includes information identifying that controller.

What was the case about?

In 2021, Groupe Canal+ carried out electronic direct marketing campaigns targeting approximately 3.9 million people. The data had been obtained from two internet service providers. On data collection forms, their subscribers could tick a box consenting to the use of their data for direct marketing by the providers’ “partners”.

However, the partners were identified neither in the forms nor in a list accessible by hyperlink or by any other means. Following complaints concerning direct marketing communications, the French Data Protection Authority imposed an administrative fine of EUR 600,000 on Groupe Canal+. The company challenged that decision before the Conseil d’État, France’s Council of State, which referred questions to the Court of Justice for a preliminary ruling.

Can the initial consent benefit a subsequent controller?

The Advocate General first distinguishes between two stages of processing. When data are initially collected, internet service providers are subject to the information obligations under Article 13 GDPR. That provision permits categories of recipients to be indicated.

The position is different when data obtained indirectly are used by a new controller for its own direct marketing. Article 14 GDPR then applies. The controller must provide the required information within a reasonable period after obtaining the data and, where the data are to be used for communication with the data subject, no later than at the time of the first communication.

The Advocate General stated that informed consent requires the data subject to receive information enabling that person to make a decision “in a ‘self-determined’ manner, in full knowledge of the facts”. In that context, the identity of the controller responsible for the marketing is of particular importance.

The Opinion emphasises that the controller’s information obligation is “the corollary of the right to information” conferred on data subjects by Articles 12 and 13 GDPR. An infringement of the obligation to provide sufficient information, in particular concerning the controller’s identity, may therefore preclude informed consent and render the processing unlawful.

Why is “partner” not a sufficiently precise category?

The Advocate General does not exclude that, in some circumstances, consent referring to a category of recipients may have legal significance. However, the category must be defined so that, having regard to the context and circumstances in which data were collected, the data subject may reasonably expect to receive marketing communications from the entity concerned.

In the case at hand, the term “partner” did not meet that standard. According to the Opinion, even in the context of electronic direct marketing, that term does not allow the data subject to understand which entities may contact him or her or what goods or services may be promoted.

The Advocate General considered that the category, while not necessarily unlimited, remained undefined. A mere contractual and commercial relationship with an internet service provider does not identify the entities that will use the data.

Is information in the first message sufficient?

No. The Opinion rejects the argument that the earlier absence of information can be remedied by an unsubscribe link included in the first marketing message.

That mechanism serves the exercise of the data subject’s rights, including the withdrawal of consent. It cannot, however, retrospectively cure the absence of prior informed consent regarding the identity of the controller, which is required before direct marketing may lawfully begin.

The Advocate General also stressed that the controller’s active information obligation cannot be replaced by the right of access under Article 15 GDPR. The right of access depends on the data subject taking the initiative, whereas the information under Articles 13 and 14 GDPR must be provided proactively to all persons concerned by the processing.

What does the Opinion mean for marketing models?

Where a controller intends to rely on data obtained by another entity on the basis of consent, it should assess not only the wording of the consent clause but also whether the data subject knew its identity when consent was given or received the necessary information before the marketing communication began.

According to the Advocate General, neither a general reference to “partners” nor the possibility of subsequently withdrawing consent discharges that obligation. Possible solutions include identifying recipients at the time of data collection, making an up-to-date and exhaustive list available, or obtaining fresh consent from the subsequent controller before direct marketing begins.

This remains an Opinion of an Advocate General, not a judgment of the Court of Justice. At this stage, only the proposed answer to the question referred has been set out; the Court will provide the final interpretation.

This material was prepared partly with the use of a general-purpose AI model and, despite due care, may contain errors. The information provided does not constitute legal advice — it reflects solely the Author's view.