62023CJ0654_RES
Case C‑654/23
Inteligo Media SA
v
Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
(Request for a preliminary ruling from the Curtea de Apel București)
Judgment of the Court (First Chamber) of 13 November 2025
(Reference for a preliminary ruling – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 13(1) and (2) – Unsolicited communications – Concept of communication ‘for the purposes of direct marketing’ – Obtaining electronic contact details ‘in the context of the sale of a product or a service’ – Registration on an online platform giving access to additional content – Sending of a daily newsletter via email – Regulation (EU) 2016/679 – Article 6 – Lawfulness of processing – Article 95 – Relationship with Directive 2002/58)
Approximation of laws – Telecommunications sector – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58 – Unsolicited communications – Concept of communication for the purposes of direct marketing – Obtaining electronic contact details in the context of the sale of a product or a service – Registration on an online platform giving access, free of charge, to certain content and to a newsletter – Free newsletter sent via email containing links to paid articles – Included
(European Parliament and Council Directive 2002/58, as amended by Directive 2009/136, Art. 13(1) and (2))
(see paragraphs 40-63, operative part 1)
Approximation of laws – Telecommunications sector – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58 – Unsolicited communications – Use of electronic mail for the purposes of direct marketing – Inapplicability of the conditions for lawful processing laid down by Regulation 2016/679
(European Parliament and Council Regulation 2016/679, recital 173 and Arts 6(1) and 95; European Parliament and Council Directive 2002/58, as amended by Directive 2009/136, Art. 13(2))
(see paragraphs 65-69, operative part 2)
Résumé
Ruling on a request for a preliminary ruling from the Curtea de Apel București (Court of Appeal, Bucharest, Romania), the Court provides clarification regarding the concepts of communication ‘for the purposes of direct marketing’ and of electronic contact details obtained ‘in the context of the sale of a product or a service’, within the meaning of Article 13(1) and (2) of the Directive on privacy and electronic communications, (
1
) in the context of registration on an online platform giving access to an electronic newsletter. The Court also clarifies the relationship between that directive and the GDPR, (
2
) concerning the conditions of lawfulness applicable to the processing of personal data carried out in the context of an unsolicited communication, within the meaning of Article 13 of that directive.
Inteligo Media is the publisher of the online news publication avocatnet.ro, intended to inform the general public, which does not specialise in the legal field, about day-to-day legislative amendments in Romania. In July 2018, that company introduced a paid subscription system for part of the content supplied to its readers. At the time of the facts in the main proceedings, Inteligo Media allowed free access to a maximum number of articles per month, beyond which the user concerned had to create a free account on the online platform operated by Inteligo Media. Registering for that service gave the user the right to access a number of additional articles per month, and to receive, free of charge, via email, a daily newsletter containing a summary of new legislation discussed in articles within the publication, including hyperlinks to those articles. The user also had the possibility of accessing, for a fee, all the articles of the publication. Users could choose either not to receive that newsletter or to unsubscribe at any time.
In September 2019, the Romanian data protection authority (‘the ANSPDCP’) drew up an infringement report, by which it imposed a fine on Inteligo Media. The ANSPDCP took the view that that company had not been able to prove that it had obtained express consent from a number of users to the processing of their personal data (email address, password, username) and that those data, initially collected for the purpose of performing the contract at issue, had been processed in a manner incompatible with that purpose, namely for the purpose of transmitting the newsletter.
By judgment delivered in December 2021, the Tribunalul București (Regional Court, Bucharest, Romania) upheld in part Inteligo Media’s application seeking the annulment of the infringement report drawn up by the ANSPDCP. In particular, it reduced the amount of the fine imposed on that company, while maintaining the finding of the administrative offence set out in the report.
Hearing the appeals brought against that judgment, the referring court is uncertain as to the legal basis for the processing of personal data at issue in the main proceedings and as to the conditions which must be satisfied in order for such processing to be regarded as lawful, in the light of the Directive on privacy and electronic communications and the GDPR. According to that court, it is necessary to clarify, inter alia, the conditions under which a user’s email address may be regarded as having been obtained ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of the Directive on privacy and electronic communications, and the scope of the concept of ‘direct marketing’ referred to in Article 13 of that directive.
Findings of the Court
In the first place, the Court notes that the provisions laid down in Article 13(1) and (2) of the Directive on privacy and electronic communications are intended to apply only to communications ‘for the purposes of direct marketing’.
The Court thus examines, first, the question whether the purpose of communicating a newsletter, such as that at issue in the main proceedings, is ‘direct marketing’ within the meaning of Article 13(1) and (2) of that directive. The Court thus recalls that the concept of communication ‘for the purposes of direct marketing’, provided for by that provision, covers communications which pursue a commercial purpose and are addressed directly and individually to a consumer. (
3
)
The Court finds that the communication at issue in the main proceedings consists of a daily newsletter distributed in the form of an email, which contains a summary of new legislation discussed in the articles of an online news publication and hyperlinks to those articles. According to the Court, the fact that that communication also has informative content does not mean that it should be excluded from the concept of communication ‘for the purposes of direct marketing’ within the meaning of Article 13(1) and (2) of the Directive on privacy and electronic communications and, therefore, from the scope of that provision.
On the contrary, the Court observes that such a communication is intended to entice the users concerned to access the paid content provided by a newspaper publisher, by promoting the exhaustion of the number of articles which can be viewed free of charge on the online platform in question and the taking out of a full subscription. It thus seeks to promote the sale of that content and thus pursues a commercial purpose. Furthermore, in so far as that communication, distributed in the form of an email, is directly displayed in the inbox of the private email service of its recipients, the Court holds that it is ‘for the purposes of direct marketing’, (
4
) irrespective of whether that purpose can be inferred solely from the content of the communication or from the structure of the sender’s offer of that communication.
The Court states that that interpretation of the concept of communication ‘for the purposes of direct marketing’ is supported by its context and by the objectives pursued by the Directive on privacy and electronic communications.
In that regard, the Court notes that Article 13(1) of the Directive on privacy and electronic communications lays down a rule of principle which makes the transmission of unsolicited communications falling within its scope subject to the requirement to obtain prior consent from the recipient. In the absence of that consent, such communication is permitted only if the conditions laid down in Article 13(2) of that directive are satisfied. That provision requires, first of all, that the sender of the communication concerned has obtained from the recipients their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with the EU data protection rules. (
5
) Subsequently, those electronic contact details may be used for direct marketing, provided that such marketing concerns similar products or services provided by that sender itself. Lastly, that use is subject to the condition that the recipients are clearly and distinctly able to object, free of charge and in an easy manner, to such use of their electronic contact details when those details are collected and on the occasion of each message in case they have not initially refused such use.
Furthermore, Article 13(4) of the Directive on privacy and electronic communications prohibits the practice of sending electronic mail for the purposes of direct marketing which disguise or conceal the identity of the sender on whose behalf the communication is made, which contravene Directive 2000/31, (
6
) which do not have a valid address to which the recipient may send a request that such communications cease or which encourage recipients to visit websites that infringe Article 6 of the Directive on electronic commerce.
The Court states that all of those safeguards are intended to achieve the objectives of the Directive on privacy and electronic communications, which seek to provide safeguards for subscribers against any intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes and e-mails, including SMS messages. Any other interpretation would risk undermining the effectiveness of Article 13 of that directive and calling into question the level of protection of privacy envisaged thereby. Therefore, the Court concludes that a communication such as that at issue in the main proceedings must be regarded as being ‘for the purposes of direct marketing’, within the meaning of Article 13(1) and (2) of the Directive on privacy and electronic communications.
Second, the Court examines whether the electronic contact details of the users concerned by the sending of the newsletter were obtained ‘in the context of the sale of a product or a service’ within the meaning of Article 13(2) of that directive.
The Court points out that, according to a commonly accepted definition, the term ‘sale’ can cover only transactions which involve the payment of remuneration. In addition, Article 13(2) of the Directive on privacy and electronic communications makes no distinction according to the type of service concerned. Thus, as regards services falling within the scope of the Directive on electronic commerce, the Court recalls that the remuneration of a service supplied by a service provider within the course of its economic activity does not require the service to be paid for by those for whom it is performed. That is the case, inter alia, where the performance of a service free of charge is provided by a service provider for the purposes of advertising the goods sold and services provided by that service provider, since the cost of that activity is incorporated into the price of those goods or services. (
7
) Those considerations can be transposed in the context of the interpretation of Article 13(2) of the Directive on privacy and electronic communications.
The Court finds that that is the case here, in so far as Inteligo Media obtained the electronic contact details of the users concerned when those users created a free account on the online platform operated by that company. By subscribing to that service, users obtained the right to access, free of charge, a number of articles published in the publication concerned and to receive the newsletter in question. The provision of such a service has, above all, an advertising purpose consisting of promoting the paid content provided by Inteligo Media, the cost of that service being included in the price of that content.
In those circumstances, indirect remuneration, included in the price of the full subscription offered by the service provider, such as that at issue in the main proceedings, satisfies the requirement inherent in the concept of ‘sale’, entailing payment as consideration for a service. Consequently, a transaction such as that in the context of which Inteligo Media obtained electronic contact details from users is capable of falling within the concept of ‘sale of … a service’ under the Directive on privacy and electronic communications.
The Court adds that that interpretation is consistent with the context in which that concept is used and the objectives pursued by the rules of which it is part. In that regard, the Court states, first, that, although the exception provided for in Article 13(2) of that directive must be interpreted strictly, it does not exclude the possibility that the remuneration required in respect of a ‘sale’, within the meaning of that provision, may be paid by a person other than the recipient of the product or service which is the subject of that transaction. On the contrary, it follows from the wording of that provision that the EU legislature merely required that the electronic contact details of the users concerned be obtained ‘in the context of the sale of a product or a service’.
Second, the interpretation of the wording of Article 13(2) of the Directive on privacy and electronic communications must, in any event, be consistent with the objective pursued by that provision. Therefore, the need for a strict interpretation of that provision cannot be understood as permitting an interpretation of those terms that would deprive them of their effectiveness. As regards the objective pursued by that provision, the EU legislature intended to provide for a derogation from the principle set out in Article 13(1) of that directive where the electronic contact details of the users concerned were obtained ‘within the context of an existing consumer relationship’, without further characterising that relationship. (
8
)
Consequently, and subject to the verifications which it is for the referring court to carry out, it appears that, in the present case, both the condition that the electronic contact details of the users concerned must have been collected ‘in the context of the sale of a product or a service’ and the condition relating to the similar nature of the service which is the subject of the marketing at issue are satisfied. In the light of the foregoing, the Court concludes that Article 13(1) and (2) of the Directive on privacy and electronic communications must be interpreted as meaning that the email address of a user is obtained by the publisher of an online publication ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of that directive, where that user creates a free account on that publisher’s online platform giving him or her the right to access, free of charge, a certain number of articles of that publication, to receive, free of charge, via email, a daily newsletter containing a summary of the new legislation discussed in articles within that publication, including hyperlinks to those articles, and the right to access, for a fee, additional articles and analyses of that publication. The transmission of such a newsletter constitutes a use of electronic mail ‘for the purposes of direct marketing’ for ‘similar products or services’ within the meaning of that provision.
In the second place, the Court clarifies the relationship between the Directive on privacy and electronic communications and the GDPR in the context of the conditions of lawfulness applicable to the processing of personal data carried out in the context of an unsolicited communication.
The Court notes that, according to the express terms of Article 95 of the GDPR, that regulation is not to impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in that directive. Furthermore, it is also apparent from the GDPR (
9
) that that regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data which are not subject to specific obligations with the same objective set out in the Directive on privacy and electronic communications, including the obligations on the controller and the rights of natural persons. However, Article 13(2) of that directive governs comprehensively the conditions and purposes of the processing as well as the rights of the data subject. It also imposes ‘specific obligations’ on the controller, within the meaning of Article 95 of the GDPR.
Consequently, the lawfulness of the processing of personal data carried out in the context of a communication falling within the scope of Article 13(2) of the Directive on privacy and electronic communications may be established on the basis of that provision, without it being necessary to assess it in the light of the conditions of lawfulness laid down by the GDPR. (
10
) In the light of the foregoing, where the controller uses the email address of a user in order to send him or her an unsolicited communication, in accordance with Article 13(2) of that directive, the conditions for lawful processing laid down in Article 6(1) of the GDPR are not applicable.
(
1
)	Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37).
(
2
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
(
3
)	Judgment of 25 November 2021, StWL Städtische Werke Lauf a.d. Pegnitz (C‑102/20, EU:C:2021:954, paragraph 47).
(
4
)	Within the meaning of Article 13(1) and (2) of the Directive on privacy and electronic communications.
(
5
)	Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) or, as the case may be, the GDPR.
(
6
)	Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce) (OJ 2000 L 178, p. 1, Article 6).
(
7
)	Judgment of 15 September 2016, Mc Fadden (C‑484/14, EU:C:2016:689, paragraphs 41 and 42).
(
8
)	Recital 41 of the Directive on privacy and electronic communications.
(
9
)	Recital 173 of the GDPR.
(
10
)	Article 6(1)(a) to (f) of the GDPR.