European Union: Council of State referred questions on GDPR consent validity for electronic direct marketing to the Court of Justice of the European Union

On 16 May 2025, the French Council of State lodged a request for a preliminary ruling with the Court of Justice of the European Union (CJEU) in Case C-317/25. The referral originates from proceedings in which Groupe Canal + SAS sought annulment of Decision No SAN-2023-015 of 12 October 2023, by which the select panel of the National Commission for Information Technology and Civil Liberties (CNIL) imposed an administrative fine of EUR 600'000 for breaches of the General Data Protection Regulation (GDPR) and the Post and Electronic Communications Code. The underlying facts concern electronic direct marketing conducted on approximately 3.9 million individuals in 2021, whose personal data had been collected by 2 internet service providers (ISPs) from their subscribers, who had consented to data use by unnamed "partners" without those partners being identified by name, via hyperlink, or by any other means. The CJEU will determine whether consent given to a primary data collector for use by an unidentified category of partner companies is sufficiently informed to allow those partners to conduct direct marketing without seeking separate consent, and whether the degree of precision of such a category is material to that assessment. Its preliminary ruling will bind the Council of State in resolving the underlying case.