On 17 September 2026, Advocate General Dean Spielmann delivered his Opinion in Groupe Canal + (Case C-317/25). The question sounds simple, but the practical consequences reach a wide range of businesses: is consent valid where the data subject allows their data to be used for marketing by a company’s unnamed “partners”?
In 2021, Groupe Canal + commissioned electronic direct marketing campaigns targeting roughly 3.9 million people. It had not collected the data itself. Two internet service providers had collected it, and the subscribers had consented to marketing by those providers’ “partners” – without any of those partners being identified.
The French data protection authority (CNIL) found that Groupe Canal + did not have valid consent and imposed a fine of EUR 600,000. The company challenged the decision before the French Conseil d’État, which referred the matter to the Court of Justice.
The Advocate General’s position
According to the Opinion, such consent is not sufficient. The reasoning rests on the four elements of valid consent: it must be freely given, specific, informed and unambiguous. To be informed, consent must allow the data subject to know who the controller is. Where the identity of the controller carrying out the marketing was unknown at the time consent was obtained, it does not follow that the individual agreed to be contacted by any company falling within the “partner” category.
In such cases, fresh consent must be obtained – at the latest at the time of the first communication.
The Advocate General also states that the option to unsubscribe does not cure the absence of prior consent. It becomes available only once the campaign has started, and therefore cannot replace the prior consent the law requires.
On the question of how precisely a category must be defined, the Advocate General considers that no answer is needed. In the alternative, however, he notes that if a category of recipients were sufficient on its own, it would have to be defined precisely enough for the data subject reasonably to expect to be contacted by the company in question. The term “partners” is too vague for that.
What this means in practice
The reasoning speaks directly to any arrangement where the party collecting the data and the party doing the marketing are not the same:
- Lead generation and list purchases. Where consent was obtained under wording such as “partners”, “carefully selected third parties” or similar generic labels, marketing based on that consent carries real risk. The buyer should establish its own legal basis rather than rely on the seller’s declaration.
- Intra-group data sharing. Group marketing often has the same structure. Here naming is usually feasible – it is worth listing the actual companies in the notice instead of referring only to “the group”.
- Affiliate and co-branded campaigns. Where the final sender is not known at the time of collection, a need for fresh consent should be expected.
- Existing databases. It is worth reviewing the wording under which earlier consents were obtained, and identifying where renewal would be needed.
An Advocate General’s Opinion does not bind the Court of Justice. The Court’s deliberations have only just begun and judgment will follow later. The Opinion is nonetheless a clear signal of direction, and on the requirement that consent be informed it is consistent with the Court’s existing case law. Reviewing your own databases now is time well spent.
If you would like to discuss whether your organisation’s marketing data processing meets these requirements, please get in touch.