Businesses urged to review marketing consent arrangements after CJEU opinion

In an opinion issued in a case involving Groupe Canal+ SAS, the AG said consent for direct marketing purposes may only be considered “informed” where the individual knows the identity of the organisation that will ultimately use their personal data for marketing.

Stephan Appt, data protection law expert at Pinsent Masons, said: “Although the opinion is not binding, a judgment following this approach could have significant consequences for businesses relying on lead generation, content syndication, affiliate marketing, demand generation programmes, data brokerage and intent-data services.”

The case arose from electronic marketing campaigns directed at around 3.9 million people. The personal data used for those campaigns had been collected by two internet service providers, with individuals having consented to receiving marketing from the providers’ “partners”. However, those partners had not been specifically identified when consent was obtained.

France’s data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), concluded that the consent was invalid and imposed a fine. Questions relating to the validity of that consent were subsequently referred to the CJEU by the French Conseil d'État.

According to the AG, consent cannot be regarded as informed where the eventual controller carrying out direct marketing activities has not been identified to the data subject. The opinion suggests that a generic reference to marketing by “partners” is not sufficient.

On that basis, where the organisation carrying out direct marketing was not identified when consent was obtained, fresh consent may need to be secured before marketing communications can be sent.

Appt said: “Many businesses currently rely on consent language that allows marketing by broadly defined categories of third parties, such as ‘partners’, ‘sponsors’ or similar commercial organisations. If the CJEU follows the advocate general’s reasoning, that approach may no longer be sufficient where personal data is used for direct marketing by a different organisation than the one that originally collected the information.”

Many business-to-business (B2B) marketing activities, including content syndication campaigns, sponsored content programmes, webinar registrations, intent-data services and lead-sharing arrangements, depend on personal data being collected by one organisation before being shared with multiple advertisers, technology vendors or sales partners.

Daniel Widmann, online marketing expert at Pinsent Masons, said: “If businesses are required to identify the eventual marketing organisation by name when consent is collected, many lead generation and demand generation processes may need to be redesigned. The commercial value of third-party lead databases could also be affected if the underlying consent does not clearly permit marketing by the ultimate recipient.”

Widmann added: “Businesses should consider reviewing consent wording used in lead generation programmes and whether third-party recipients are identified with sufficient precision at the point of data collection. Firms should also review contractual arrangements with lead providers and marketing partners, as well as their reliance on purchased marketing databases for electronic direct marketing.”

Appt added: “Organisations should not view this as a narrow data protection case. If confirmed by the CJEU, the decision may fundamentally reshape how marketing consent is collected, documented and relied upon across the European digital advertising and business-to-business lead generation market.”