EU Advocate General Defines Stricter Marketing Consent
Data collection must now clearly identify marketing entities for user consent to remain valid.
Updated on Oct. 27, 2026 in Advertising
Live Poll
Should companies be required to name every organization that will use your personal data for marketing?
The CJEU advocate general has issued an opinion stating that informed consent for direct marketing requires identifying the specific organization that will use personal data. Generic references to partner marketing are no longer considered sufficient under EU data protection standards.
Why it matters
This opinion aims to ensure that individuals are fully aware of exactly who will process their information when providing consent. It establishes a necessary framework for transparency, preventing the use of vague disclosures in data collection.
The advocate general's opinion stems from a case involving electronic marketing campaigns that targeted approximately 3.9 million people. This follows a previous fine imposed by the French CNIL for invalid consent practices.
The players
Groupe Canal+ SAS
This is a major French television company that was previously fined by the CNIL for its consent practices.
CNIL
The National Commission on Informatics and Liberty is the French data protection authority responsible for regulating privacy.
Conseil d'État
The Conseil d'État serves as the supreme administrative court in France and referred this consent case to the European court.
CJEU
The Court of Justice of the European Union is the highest judicial authority in the EU regarding the interpretation of union law.
The details
The advocate general argued that data subjects cannot provide informed consent if the identity of the final data user remains unknown at the point of collection. This opinion follows a request for clarity from the French Conseil d'État regarding the validity of consent processes used by Groupe Canal+ SAS.
Timeline
The advocate general's opinion was published on October 27, 2026.
Market Landscape
This opinion represents a significant evolution in digital compliance that forces a shift away from broad, opaque lead-generation practices. It positions businesses to reconsider the commercial value of third-party lead databases that lack explicit entity disclosure.
Customers can expect more detailed disclosures and fewer generic opt-in boxes when signing up for services. This change increases control over personal data by ensuring users know exactly which companies are being granted access to their information.
The takeaway
Companies should proactively audit their data collection forms to ensure every third-party entity is clearly named. Focusing on transparent consent processes can help avoid regulatory scrutiny and maintain long-term consumer trust.
Further reading
For more context on how privacy regulations shape industry standards, visit the Advertising section.
Source note: This article includes information reported by Pinsent Masons.
Live Poll
Should companies be required to name every organization that will use your personal data for marketing?
