Marketing consent for ‘partners’: what does the Canal+ case mean?

Picture the marketing team buying 40,000 leads from a prize draw website. Entrants ticked a box saying ‘Yes, I would like offers from our partners’, and the supplier warrants that everything is in order. On the Advocate General’s reading in Canal+, that is not enough. None of those people knew it would be you making the offer.

What was the Canal+ case about?

In 2021 Groupe Canal+ commissioned email campaigns aimed at around 3.9 million people. Their data had been collected by two internet service providers, whose subscribers had ticked a box allowing the providers’ ‘partners’ to use it for marketing. The partners were not named, either on the form or in a list behind a link.

The French data protection authority, CNIL, found that Canal+ lacked valid consent and fined it EUR 600,000 on 12 October 2023. Canal+ appealed to the Conseil d’État, which in May 2025 asked the Court of Justice whether consent given for a category of recipients such as ‘partners’ allows each of them to market without asking again.

Is marketing consent given to ‘partners’ valid?

No, according to Advocate General Dean Spielmann in his Opinion of 17 September 2026. Consent must be informed under GDPR Art. 4(11), which means the data subject must know the identity of the controller doing the marketing. The prior consent requirement in ePrivacy Directive Art. 13(1) has to be read together with the transparency duty in GDPR Art. 14, which requires the recipient to say who it is. If its identity was unknown when consent was given, the recipient must obtain fresh consent before the marketing starts.

Canal+ argued that recipients could unsubscribe in the very first email. The Advocate General rejected that. The unsubscribe link is needed so that consent can be withdrawn, but it does not retrospectively make up for consent that was missing before the campaign went out.

Whoever sends the marketing must have been known to the recipient when consent was given. Otherwise the sender has no consent.

The Opinion does not bind the Court, and judgment will follow later. The Advocate General added that ‘partners’ is in any event too vague for anyone to expect contact from a particular business.

Is this new?

Not really. The European Data Protection Board says in its Guidelines 05/2020 on consent, paragraph 65, that every controller wishing to rely on the original consent should be named. Planet49 (C-673/17) concerned consent to cookies used to advertise partners’ products in an online prize game, and the Court rejected pre-ticked boxes. Orange Romania (C-61/19) held that the controller must prove consent and that the information must have been given beforehand. What the Advocate General adds is the full consequence for whoever buys or receives the data.

What are the marketing consent rules in Norway?

Marketing by email and SMS to natural persons requires prior consent under Marketing Control Act § 15 of the Norwegian Marketing Control Act (markedsføringsloven). The Norwegian Consumer Authority (Forbrukertilsynet) enforces the rule, and its guidance on marketing by email and SMS already requires an up-to-date list naming the partners in the consent statement. A business buying a database must itself show that the consents are genuine. A warranty from the seller is not sufficient.

The same guidance also allows a business to buy a consent database if it notifies the consumers and explains how to withdraw consent. In our view that route is hard to square with the Advocate General’s reasoning where the buyer was not named in the original statement. A notice in the first message is precisely what he says does not cure the defect. If the Court follows the Opinion, its reading of the GDPR will carry weight in Norway through the EEA Agreement.

The existing customer exception in Marketing Control Act § 15(3) does not help with bought lists, because it requires a sale by you. The rules on newsletters and cookies are covered in the article on cookie consent, and there are more articles on the topic page on data protection.

What should you do when buying leads or running joint campaigns?

A lead supplier is normally an independent controller, not a processor. A standard data processing agreement is therefore a poor fit. You need a data sharing agreement that allocates responsibility.

1. Ask for the consent wording as it appeared, with the date, the channel and the list of named partners at that time.
2. Agree audit rights, a duty to produce evidence for each contact, and an indemnity if the consents do not hold up.
3. Ask the supplier to name you in the consent statement before collection begins. The Advocate General pointed to that solution himself.
4. Name every sender in joint campaigns and prize draws run with partners.
5. Stop sending to bought lists on which you were not named until fresh consent has been obtained.

Go through the lists already sitting in your CRM system. Tag each contact with its source and consent wording, so you know which ones you can still email when the judgment lands.

Questions and answers

Next legal review: 30 June 2027