Contents
Judgment of the Court (First Chamber)13 November 2025note(Reference for a preliminary ruling — Processing of personal data and the protection of privacy in the electronic communications sector — Directive 2002/58/EC — Article 13(1) and (2) — Unsolicited communications — Concept of communication for the purposes of direct marketing — Obtaining electronic contact details in the context of the sale of a product or a service — Registration on an online platform giving access to additional content — Sending of a daily newsletter via email — Regulation (EU) 2016/679 — Article 6 — Lawfulness of processing — Article 95 — Relationship with Directive 2002/58)In Case C‑654/23,REQUEST for a preliminary ruling under Article 267 TFEU from the Curtea de Apel Bucureşti (Court of Appeal, Bucharest, Romania), made by decision of 20 March 2023, received at the Court on 2 November 2023, in the proceedingsInteligo Media SAvAutoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP),THE COURT (First Chamber),composed of F. Biltgen, President of the Chamber, T. von Danwitz, Vice-President of the Court, acting as Judge of the First Chamber, I. Ziemele (Rapporteur), A. Kumin and S. Gervasoni, Judges,Advocate General: M. Szpunar,Registrar: R. Șereș, Administrator,having regard to the written procedure and further to the hearing on 27 November 2024,after considering the observations submitted on behalf of:– Inteligo Media SA, by S.A. Opriş and A.-M. Radu, avocate,– the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), by A.G. Opre, acting as Agent,– the Romanian Government, by R. Antonie, E. Gane and L. Ghiţă, acting as Agents,– the European Commission, by A. Bouchagiar, P.-J. Loewenthal and L. Nicolae, acting as Agents,after hearing the Opinion of the Advocate General at the sitting on 27 March 2025,gives the following
Judgment
1This request for a preliminary ruling concerns the interpretation of (i) Article 13(1) and (2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 11) (‘Directive 2002/58’), and (ii) Article 6(1), Article 83(2) and Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), read in conjunction with Article 15(2) of Directive 2002/58.
2The request has been made in proceedings between Inteligo Media SA and the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (National Supervisory Authority for the Processing of Personal Data (ANSPDCP), Romania) concerning the administrative penalty imposed on that company on the ground that it had processed its customers’ personal data without their consent.
Legal context
European Union law
Directive 2002/58
3Recitals 2, 10, 40 and 41 of Directive 2002/58 state:(2) This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the Charter of fundamental rights of the European Union. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter.…(10) In the electronic communications sector, Directive 95/46/EC [of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)] applies in particular to all matters concerning protection of fundamental rights and freedoms, which are not specifically covered by the provisions of this Directive, including the obligations on the controller and the rights of individuals. ……(40) Safeguards should be provided for subscribers against intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes, and e-mails, including SMS messages. These forms of unsolicited commercial communications may on the one hand be relatively easy and cheap to send and on the other may impose a burden and/or cost on the recipient. Moreover, in some cases their volume may also cause difficulties for electronic communications networks and terminal equipment. For such forms of unsolicited communications for direct marketing, it is justified to require that prior explicit consent of the recipients is obtained before such communications are addressed to them. The single market requires a harmonised approach to ensure simple, Community-wide rules for businesses and users.(41) Within the context of an existing customer relationship, it is reasonable to allow the use of electronic contact details for the offering of similar products or services, but only by the same company that has obtained the electronic contact details in accordance with Directive 95/46/EC. When electronic contact details are obtained, the customer should be informed about their further use for direct marketing in a clear and distinct manner, and be given the opportunity to refuse such usage. This opportunity should continue to be offered with each subsequent direct marketing message, free of charge, except for any costs for the transmission of this refusal.’
4Article 1 of Directive 2002/58, entitled ‘Scope and aim’, provides, in paragraphs 1 and 2 thereof:1. This Directive provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Community.2. The provisions of this Directive particularise and complement Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons.’
5Article 2 of Directive 2002/58, entitled ‘Definitions’, provides, in the second paragraph thereof:‘The following definitions shall also apply:…(d) “communication” means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information;…(h) “electronic mail” means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient;…’
6Under Article 13 of that directive, entitled ‘Unsolicited communications’:1. The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent.2. Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use.…4. In any event, the practice of sending electronic mail for the purposes of direct marketing which disguise or conceal the identity of the sender on whose behalf the communication is made, which contravene Article 6 of Directive 2000/31/EC [of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce) (OJ 2000 L 178, p. 1)], which do not have a valid address to which the recipient may send a request that such communications cease or which encourage recipients to visit websites that contravene that Article shall be prohibited.…’
The GDPR
7Recital 173 of the GDPR states:‘This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data which are not subject to specific obligations with the same objective set out in [Directive 2002/58], including the obligations on the controller and the rights of natural persons. In order to clarify the relationship between this Regulation and [Directive 2002/58], that Directive should be amended accordingly. Once this Regulation is adopted, [Directive 2002/58] should be reviewed in particular in order to ensure consistency with this Regulation.’
8Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides, in paragraph 1 thereof:‘Personal data shall be:(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (“purpose limitation”);…’
9Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides, in the first subparagraph of paragraph 1 thereof:‘Processing shall be lawful only if and to the extent that at least one of the following applies:(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;…(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’
10Article 7 of that regulation, entitled ‘Conditions for consent’, is worded as follows:1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.2. If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.…4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.’
11Under Article 83 of the GDPR, entitled ‘General conditions for imposing administrative fines’:1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.2.Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:(a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;(b) the intentional or negligent character of the infringement;(c) any action taken by the controller or processor to mitigate the damage suffered by data subjects;(d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;(e) any relevant previous infringements by the controller or processor;(f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;(g) the categories of personal data affected by the infringement;(h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject matter, compliance with those measures;(j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and(k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.…5.Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20000000 [euro], or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;…’
12Article 95 of that regulation, entitled ‘Relationship with [Directive 2002/58]’, provides:‘This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the [European] Union in relation to matters for which they are subject to specific obligations with the same objective set out in [Directive 2002/58].’
Directive 2000/31
13Article 2 of Directive 2000/31, entitled ‘Definitions’, provides:‘For the purposes of this Directive, the following terms shall bear the following meanings:…(f) “commercial communication”: any form of communication designed to promote, directly or indirectly, the goods, services or image of a company, organisation or person pursuing a commercial, industrial or craft activity or exercising a regulated profession. The following do not in themselves constitute commercial communications:– information allowing direct access to the activity of the company, organisation or person, in particular a domain name or an electronic-mail address,– communications relating to the goods, services or image of the company, organisation or person compiled in an independent manner, particularly when this is without financial consideration;…’
14Article 6 of that directive, entitled ‘Information to be provided’, states:‘In addition to other information requirements established by Community law, Member States shall ensure that commercial communications which are part of, or constitute, an information society service comply at least with the following conditions:(a) the commercial communication shall be clearly identifiable as such;(b) the natural or legal person on whose behalf the commercial communication is made shall be clearly identifiable;(c) promotional offers, such as discounts, premiums and gifts, where permitted in the Member State where the service provider is established, shall be clearly identifiable as such, and the conditions which are to be met to qualify for them shall be easily accessible and be presented clearly and unambiguously;(d) promotional competitions or games, where permitted in the Member State where the service provider is established, shall be clearly identifiable as such, and the conditions for participation shall be easily accessible and be presented clearly and unambiguously.’
Romanian law
Law No 506/2004
15Article 1(2) and (3) of Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice (Law No 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector) of 17 November 2004 (Monitorul Oficial al României, Part I, No 1101 of 25 November 2004) states:2. The provisions of this Law shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services on public electronic communications networks, including public communications networks supporting data collection and identification devices.3. The provisions of this Law shall be supplemented by the provisions of Legea nr. 677/2001 pentru protecția persoanelor cu privire la prelucrarea datelor cu caracter personal și libera circulație a acestor date [(Law No 677/2001 on the protection of individuals with regard to the processing of personal data and on the free movement of such data) of 21 November 2001 (Monitorul Oficial al României, Part I, No 790 of 12 December 2001)].’
16Article 2 of Law No 506/2004 provides, in paragraphs 1 and 2 thereof:1.For the purpose of this Law, the following terms shall bear the following meanings:…(d) communication – any information exchanged or transmitted between a specified number of participants by means of a publicly available electronic communications service; this does not include information transmitted to the public over an electronic communications network as part of an audiovisual programme service to the extent that the information concerned cannot be related to the identifiable subscriber or user receiving the information;…2. The definitions set out … in Article 1(1) and (8) of Legea nr. 365/2002 privind comerțul electronic [(Law No 365/2002 on electronic commerce) of 7 June 2002 (republished in Monitorul Oficial al României, Part I, No 959 of 29 November 2006)] … shall also apply to this Law.’
17Under Article 12(1) and (2) of Law No 506/2004:1. It shall be prohibited to carry out commercial communications by using automated calling and communication systems which do not require the involvement of a human operator, by fax or by electronic mail or by any other method which uses publicly available electronic communications services, unless the subscriber or user concerned has given his or her express consent to the receipt of such communications in advance.2. Without prejudice to the provisions of paragraph 1, if a natural or legal person obtains directly the email address of a customer when selling a product or a service to that customer, in accordance with Law No 677/2001, that natural or legal person may use that address for commercial communications purposes in relation to similar products or services which it markets, provided that it clearly and distinctly offers customers the possibility of objecting to such use by a means which is easy and free of charge, both when obtaining the email address and on the occasion of each message, if the customer did not initially object to the use.’
18Article 13(1), (2) and (5) of Law No 506/2004 reads as follows:1. The following acts shall constitute administrative offences:…(q) failure to comply with the provisions of Article 12 concerning unsolicited communications.2. The administrative offences referred to in paragraph 1(a) to (l), (n), (o) and (q) shall be punishable by a fine of 5000 [Romanian lei (RON) (approximately EUR 984)] to RON 100000 [(approximately EUR 19697)] and, for commercial companies with a turnover exceeding RON 5000000 [(approximately EUR 984892)], … a fine of up to 2% of turnover.…5. The identification of the administrative offences referred to in paragraph 1(a) to (j) and (l) to (q) and the application of penalties shall be carried out by members of staff of the ANSPDCP authorised to do so.’
Law No 365/2002
19Article 1(8) of Law No 365/2002 provides:‘For the purpose of this Law, the following terms shall bear the following meanings:…8. commercial communication – any form of communication designed to promote, directly or indirectly, the products, services, image, name, signature or logo of a trader or a member of a regulated profession; the following do not in themselves constitute commercial communications: information allowing the activity of a natural or legal person to be accessed directly, including a domain name or an electronic-mail address, [or] communications relating to the products, services, images, names or trade marks of a natural or legal person, carried out by a third party independent of that person, particularly when this is done free of charge’.
The dispute in the main proceedings and the questions referred for a preliminary ruling
20Inteligo Media is the publisher of the online news publication avocatnet.ro, intended to provide information to the general public, which does not specialise in the legal field, on legislative amendments issued each day in Romania.
21On 27 July 2018, that company introduced, under the commercial name ‘Serviciu Premium’ (‘the Premium Service’), a paid subscription system for part of the content provided to its readers. At the time of the facts in the main proceedings, the company allowed a maximum number of six articles per month to be viewed free of charge by any user. In order to access additional articles, the user concerned, initially, had to create a free account on the online platform in question, which meant that that user accepted the contractual terms and conditions for the provision of the Premium Service. By registering for that service, that user obtained the right to access, free of charge, two additional articles per month, to receive, free of charge, via email, the daily newsletter, entitled ‘Personal Update’, containing an overview of the previous day’s legislative developments, with hyperlinks to the relevant articles available on that platform, and the right to access, on an optional basis and for a fee, all the articles of the publication and to receive, via email, the full version of that newsletter, entitled ‘Sinteze Informative’ (‘Informative Summaries’).
22When creating an account, users could choose not to receive the ‘Personal Update’ newsletter by ticking the box ‘I do not want to receive “Personal Update”’ included in the online form which was to be filled in for the purpose of creating that account. Similarly, each time they received that newsletter, users who no longer wished to receive it could select the ‘DEZABONARE’ (‘UNSUBSCRIBE’) option.
23On 26 September 2019, the ANSPDCP drew up an infringement report, by which it imposed on Inteligo Media a fine of RON 42714 (approximately EUR 9000) for infringement of Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 of the GDPR. The ANSPDCP took the view that that company had not been able to prove that it had obtained express consent from 4357 users to the processing of their personal data (email address, password, username) and that it had processed those data in a manner incompatible with the purpose for which they had initially been collected. Those data, initially collected for the purpose of performing the contract at issue, had been processed for the purpose of transmitting the ‘Personal Update’ newsletter.
24Inteligo Media brought an action before the Tribunalul București (Regional Court, Bucharest, Romania) seeking, principally, the annulment of that report.
25In support of its application, the company claimed, inter alia, that, because of its essentially editorial content, the ‘Personal Update’ newsletter did not satisfy the conditions laid down by the law for classification as a ‘commercial communication’. However, as a precautionary measure, the processing of personal data as a result of the transmission of that newsletter was based on Article 12(2) of Law No 506/2004, transposing Article 13(2) of Directive 2002/58 into Romanian law, and on Article 6(1)(f) of the GDPR. That company thus gave users the right to object to the receipt of that newsletter and the right to unsubscribe after such a newsletter had been received.
26By judgment of 5 June 2020, the Tribunalul București (Regional Court, Bucharest) dismissed that application, endorsing the arguments put forward by the ANSPDCP.
27By judgment of 15 April 2021, the Curtea de Apel București (Court of Appeal, Bucharest, Romania), ruling on the appeal brought by Inteligo Media against the judgment at first instance, set aside that judgment and referred the case back to the Tribunalul București (Regional Court, Bucharest) for a new ruling, on the ground that that court had not given sufficient reasons for its judgment.
28After the re-examination, by judgment of 15 December 2021, the Tribunalul București (Regional Court, Bucharest) upheld Inteligo Media’s application in part and reduced the amount of the fine imposed on it by the ANSPDCP. However, it maintained the finding of the administrative offence set out in the infringement report of 26 September 2019.
29Hearing the appeals brought against that judgment by Inteligo Media and the ANSPDCP, the Curtea de Apel București (Court of Appeal, Bucharest), which is the referring court, considers that the outcome of the dispute in the main proceedings depends on the identification of the legal basis for the processing of personal data at issue in the main proceedings and the conditions which must be satisfied in order for such processing to be regarded as lawful, in the light of Directive 2002/58 and the GDPR.
30According to that court, it is necessary to begin by clarifying (i) the conditions under which a user’s email address may be regarded as having been obtained ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of Directive 2002/58, (ii) the scope of the concept of ‘direct marketing’ referred to in Article 13 of the directive, and (iii) whether that concept is equivalent to that of ‘commercial communication’, used by the Romanian legislature when transposing Article 13 of that directive.
31Subsequently, if, in the present case, the users’ email addresses have not been obtained ‘in the context of the sale of a product or a service’ within the meaning of Article 13(2) of Directive 2002/58, it is necessary to determine whether the transmission via email of the ‘Personal Update’ newsletter falls within the scope of Article 13(1) of that directive and of the provisions penalising any infringement thereof.
32Lastly, the referring court considers it necessary to clarify the obligations incumbent on a supervisory authority when it applies Article 83(2) of the GDPR, in so far as those obligations are not clear from the wording of that provision.
33In those circumstances, the Curtea de Apel București (Court of Appeal, Bucharest) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:(1) In a case in which a publisher of online news publications providing information to the general public, which does not specialise in the field, regarding the legislative amendments issued each day in Romania, obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free daily newsletter:(a) is that email address obtained by the publisher of the online news publication “in the context of the sale of a product or a service” within the meaning of Article 13(2) of [Directive 2002/58]?(b) is the transmission by the news publisher of a newsletter such as that described in the abovementioned point (ii) carried out “for direct marketing of its own similar products or services” within the meaning of Article 13(2) of [Directive 2002/58]?(2) If the answers to Question 1(a) and (b) are in the affirmative, which of the conditions laid down in Article 6(1)(a) to (f) of [the GDPR] must be interpreted as applying when the publisher uses the user’s email address for the purpose of sending a daily newsletter such as that described in Question 1(ii), in accordance with the requirements of Article 13(2) of [Directive 2002/58]?(3) Must Article 13(1) and (2) of [Directive 2002/58] be interpreted as precluding national legislation which uses the concept of “commercial communication” laid down in Article 2(f) of [Directive 2000/31] instead of the concept of “direct marketing” laid down in [Directive 2002/58]? If not, does a newsletter such as that described in Question 1(ii) constitute a “commercial communication” within the meaning of Article 2(f) of [Directive 2000/31]?4. If the answers to Question 1(a) and (b) are in the negative:(a) does the transmission via email of a daily newsletter such as that described in Question 1(ii) constitute “use … of electronic mail for the purposes of direct marketing” within the meaning of Article 13(1) of [Directive 2002/58]?(b) must Article 95 of [the GDPR], in conjunction with Article 15(2) of [Directive 2002/58], be interpreted as meaning that failure to comply with the conditions for obtaining valid consent from the user pursuant to Article 13(1) of [Directive 2002/58] will be penalised in accordance with Article 83 of [the GDPR] or in accordance with the provisions of national law contained in the act transposing [Directive 2002/58], which contains specific penalties?5. Must Article 83(2) of [the GDPR] be interpreted as meaning that a supervisory authority which decides whether to impose an administrative fine and decides on the amount of the administrative fine in each individual case is obliged to analyse and explain in the administrative act imposing the fine the effect of each of the criteria laid down in points (a) to (k) on the decision to impose a fine and, respectively, on the decision regarding the amount of the fine imposed?’
Consideration of the questions referred
The first question and point (a) of the fourth question
34By its first question and point (a) of its fourth question, which it is appropriate to examine together, the referring court asks, in essence, whether Article 13(1) and (2) of Directive 2002/58 is to be interpreted as meaning that the email address of a user is obtained by the publisher of an online publication ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of that directive, where that user creates a free account on that publisher’s online platform giving him or her the right to access, free of charge, a certain number of articles of that publication, to receive, free of charge, via email, a daily newsletter containing a summary of the new legislation discussed in articles within that publication, including hyperlinks to those articles, and the right to access, for a fee, additional articles and analyses of that publication, and that the transmission of such a newsletter constitutes a use of electronic mail ‘for the purposes of direct marketing’ for ‘similar products or services’ within the meaning of that provision.
35In order to answer those questions, it should be borne in mind that, under Article 1(1) of Directive 2002/58, that directive provides, inter alia, for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector.
36Article 2(d) of Directive 2002/58 provides a broad definition of the concept of ‘communication’ that includes any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service.
37Article 13 of that directive, entitled ‘Unsolicited communications’, authorises, in paragraph 1 thereof, the use of different types of communications (namely – in particular – electronic mail) for the purposes of direct marketing, on condition that they concern subscribers or users who have given their prior consent.
38As an exception to the requirement for such consent, Article 13(2) of Directive 2002/58 provides that, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46 or the GDPR, that natural or legal person may use these electronic contact details for direct marketing provided that that natural or legal person complies with the conditions set out in that provision.
39It is apparent from the wording of the provisions referred to in paragraphs 37 and 38 of the present judgment that those provisions are intended to apply only to communications ‘for the purposes of direct marketing’. Therefore, in order to answer the first question and point (a) of the fourth question, it is necessary to determine, first, whether the purpose of communicating a newsletter such as that at issue in the main proceedings is direct marketing and, if so, second, whether the electronic contact details of the users concerned were obtained by the sender of that communication ‘in the context of the sale of … a service’ within the meaning of Article 13(2) of Directive 2002/58.
40In accordance with settled case-law, in uniformly interpreting a provision of EU law, it is necessary to consider not only its wording, but also the context of that provision and the objectives pursued by the rules of which it is part (see judgments of 17 November 1983, Merck, 292/82, EU:C:1983:335, paragraph 12, and of 1 August 2025, Alace and Canpelli, C‑758/24 and C‑759/24, EU:C:2025:591, paragraph 91).
41As regards, in the first place, the wording of Article 13(1) and (2) of Directive 2002/58, it should be noted that that provision contains no indication as to the meaning of the concept of communication ‘for the purposes of direct marketing’. Nevertheless, it is clear from the case-law of the Court that it covers communications which pursue a commercial purpose and are addressed directly and individually to a consumer (see, to that effect, judgment of 25 November 2021, StWL Städtische Werke Lauf a.d. Pegnitz, C‑102/20, EU:C:2021:954, paragraph 47).
42In the light of those criteria, the Court has held that advertising messages which promote services and are distributed in the form of an email, so that they are directly displayed in the inbox of the private email service of the user concerned, constitute such communications (see, to that effect, judgment of 25 November 2021, StWL Städtische Werke Lauf a.d. Pegnitz, C‑102/20, EU:C:2021:954, paragraph 48).
43In the present case, as is apparent from the order for reference, the communication at issue in the main proceedings consists of a daily newsletter, distributed in the form of an email, which contains a summary of the new legislation discussed in the articles of an online news publication and hyperlinks to those articles. It is only by following those hyperlinks that the users concerned can consult the full content, free of charge, up to a maximum of eight articles per month and, for a fee, all the articles available on the online platform operated by Inteligo Media.
44The fact mentioned by the referring court that, inasmuch as it contains a summary of the subjects dealt with in the articles of that publication, that communication also has informative content does not mean that it should be excluded from the concept of communication ‘for the purposes of direct marketing’, within the meaning of Article 13(1) and (2) of Directive 2002/58, and, therefore, from the scope of that provision.
45On the contrary, as the Advocate General observed, in essence, in points 32 to 34 of his Opinion, such a communication is intended to entice the users concerned to access the paid content provided by a newspaper publisher, by promoting the exhaustion of the number of articles which can be viewed free of charge on the online platform in question and the taking out of a full subscription. It thus seeks to promote the sale of that content and, consequently, pursues a commercial purpose, within the meaning of the case-law cited in paragraph 41 of the present judgment. Furthermore, in so far as that communication, distributed in the form of an email, is directly displayed in the inbox of the private email service of its recipients, it must be held that it is ‘for the purposes of direct marketing’, within the meaning of Article 13(1) and (2) of Directive 2002/58, irrespective of whether that purpose can be inferred solely from the content of that communication or from the structure of the sender’s offer of that communication.
46That interpretation of the concept of communication ‘for the purposes of direct marketing’ is supported, in the second place, by the context in which it occurs and by the objectives pursued by Directive 2002/58.
47In that regard, it should be noted that Article 13(1) of Directive 2002/58 lays down a rule of principle, which makes the transmission of unsolicited communications falling within its scope subject to the requirement to obtain prior consent from the recipient.
48In the absence of such consent, such communication is permitted only if the conditions laid down in Article 13(2) of Directive 2002/58 are satisfied. That provision requires, first of all, that, in accordance with Directive 95/46 or, as the case may be, the GDPR, the sender of the communication concerned has obtained from the recipients of that communication their electronic contact details for electronic mail, in the context of the sale of a product or a service. Subsequently, those electronic contact details may be used for direct marketing, provided that such marketing concerns similar products or services provided by that sender itself. Lastly, that use is subject to the condition that those recipients are clearly and distinctly able to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case they have not initially refused such use.
49Furthermore, Article 13(4) of Directive 2002/58 prohibits, in any event, the practice of sending electronic mail for the purposes of direct marketing which disguise or conceal the identity of the sender on whose behalf the communication is made, which contravene Article 6 of Directive 2000/31, which do not have a valid address to which the recipient may send a request that such communications cease or which encourage recipients to visit websites that infringe Article 6 of Directive 2000/31.
50All of the safeguards recalled in paragraphs 47 to 49 of the present judgment are intended to achieve the objectives pursued by Directive 2002/58, as set out in recitals 2 and 40 thereof, which seek, inter alia, to ensure full respect for the rights set out in Articles 7 and 8 of the Charter of Fundamental Rights and, to that end, to provide safeguards for subscribers against any intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes and e-mails, including SMS messages.
51Any other interpretation would risk undermining the effectiveness of Article 13 of Directive 2002/58 and thus calling into question the level of protection of privacy envisaged thereby. If an interpretation to the contrary were accepted, the transmission of a communication such as that at issue in the main proceedings would fall outside of the safeguards laid down in Article 13 of that directive, notwithstanding the risk of undermining the privacy of users of email services.
52Given that a communication such as that at issue in the main proceedings must be regarded as being ‘for the purposes of direct marketing’, within the meaning of Article 13(1) and (2) of Directive 2002/58, it is necessary to examine, second, whether the condition referred to in Article 13(2) of that directive and referred to in paragraph 39 of the present judgment, according to which the electronic contact details of customers must have been obtained by the sender of that communication ‘in the context of the sale of … a service’, is satisfied.
53In the first place, as the Advocate General stated in point 40 of his Opinion, according to a commonly accepted definition, the term ‘sale’ refers to an agreement which necessarily entails a payment in exchange for a good or a service. That term is therefore capable of covering only transactions which involve the payment of remuneration.
54It should also be noted that Article 13(2) of Directive 2002/58 refers, in general terms, to ‘service[s]’, without making any distinction according to the type of service concerned. As regards services falling within the scope of Directive 2000/31, the Court has held that the remuneration of a service supplied by a service provider within the course of its economic activity does not require the service to be paid for by those for whom it is performed. That is the case, inter alia, where the performance of a service free of charge is provided by a service provider for the purposes of advertising the goods sold and services provided by that service provider, since the cost of that activity is incorporated into the price of those goods or services (judgment of 15 September 2016, Mc Fadden, C‑484/14, EU:C:2016:689, paragraphs 41 and 42 and the case-law cited). Those considerations can be transposed in the context of the interpretation of Article 13(2) of Directive 2002/58.
55That is specifically the case here. As is apparent from the wording of the first question and the grounds of the order for reference, the electronic contact details of the users concerned were obtained by Inteligo Media when users created a free account on the online platform operated by that company, which presupposed the acceptance, by those users, of the contractual terms for the provision of the Premium Service. By subscribing to that service, users obtained the right to access, free of charge, a number of articles published in the publication concerned and to receive the ‘Personal Update’ newsletter. As is apparent from paragraph 45 of the present judgment, the provision of such a service has, above all, an advertising purpose consisting of promoting the paid content provided by Inteligo Media, the cost of that service being included in the price of that content.
56In those circumstances it must be held, as the Advocate General did in point 43 of his Opinion, that indirect remuneration, included in the price of the full subscription offered by the service provider, such as that at issue in the main proceedings, satisfies the requirement of payment referred to in paragraph 53 of the present judgment.
57Consequently, a transaction such as that in the context of which Inteligo Media obtained electronic contact details from users is capable of falling within the concept of ‘sale of … a service’ within the meaning of Article 13(2) of Directive 2002/58.
58That interpretation is, in the second place, consistent with the context in which that concept is used and the objectives pursued by the rules of which it is part.
59In that regard, it is true that Article 13(2) of Directive 2002/58 provides for an exception, which derogates from the rule of principle laid down in Article 13(1) thereof, and that it must, therefore, be interpreted strictly. However, first, the wording of Article 13(2) of that directive does not exclude the possibility that the remuneration required in respect of a ‘sale’ transaction, within the meaning of that latter provision, may be paid by a person other than the recipient of the product or service which is the subject of that transaction. On the contrary, it follows from that wording that the EU legislature merely required that the electronic contact details of the users concerned be obtained ‘in the context of the sale of a product or a service’.
60Second, the interpretation of the wording of Article 13(2) of Directive 2002/58 must, in any event, be consistent with the objective pursued by that provision. It follows that the need for such a strict interpretation cannot be understood as permitting an interpretation of those terms that would deprive them of their effectiveness (see, by analogy, judgment of 4 March 2021, Frenetikexito, C‑581/19, EU:C:2021:167, paragraph 22 and the case-law cited).
61As regards the objective pursued by Article 13(2) of Directive 2002/58, it is apparent from recital 41 of that directive that the EU legislature intended to provide for a derogation from the principle set out in Article 13(1) thereof where the electronic contact details of the users concerned were obtained ‘within the context of an existing customer relationship’, without further characterising that relationship.
62Consequently, and subject to the verifications which it is for the referring court to carry out, it appears that, in the present case, both the condition that the electronic contact details of the users concerned must have been collected ‘in the context of the sale of a product or a service’ and the condition, as is apparent from paragraphs 55 and 56 of the present judgment, relating to the similar nature of the service which is the subject of the marketing at issue are satisfied.
63In the light of all of the foregoing considerations, the answer to the first question and point (a) of the fourth question is that Article 13(1) and (2) of Directive 2002/58 must be interpreted as meaning that the email address of a user is obtained by the publisher of an online publication ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of that directive, where that user creates a free account on that publisher’s online platform giving him or her the right to access, free of charge, a certain number of articles of that publication, to receive, free of charge, via email, a daily newsletter containing a summary of the new legislation discussed in articles within that publication, including hyperlinks to those articles, and the right to access, for a fee, additional articles and analyses of that publication. The transmission of such a newsletter constitutes a use of electronic mail ‘for the purposes of direct marketing’ for ‘similar products or services’ within the meaning of that provision.
The second question
64By its second question, the referring court asks, in essence, whether Article 13(2) of Directive 2002/58, read in conjunction with Article 95 of the GDPR, is to be interpreted as meaning that, where the controller uses the email address of a user in order to send him or her an unsolicited communication, in accordance with Article 13(2) of that directive, the conditions for lawful processing laid down in Article 6(1) of that regulation are applicable.
65As the Court has repeatedly held, the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as lawful, processing must fall within one of the cases provided for in that provision (judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 99, and of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 25 and the case-law cited).
66That being so, according to the express terms of Article 95 of the GDPR, that regulation is not to impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58.
67Furthermore, recital 173 of that regulation states, similarly, that that regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data which are not subject to specific obligations with the same objective set out in Directive 2002/58, including the obligations on the controller and the rights of natural persons.
68However, as the Advocate General noted in point 50 of his Opinion, Article 13(2) of Directive 2002/58 governs comprehensively the conditions and purposes of the processing as well as the rights of the data subject and imposes ‘specific obligations’ on the controller, within the meaning of Article 95 of the GDPR. Consequently, the lawfulness of the processing of personal data carried out in the context of a communication falling within the scope of Article 13(2) of that directive may be established on the basis of that provision, without it being necessary to assess it in the light of the conditions laid down in Article 6(1)(a) to (f) of the GDPR.
69In the light of all of the foregoing, the answer to the second question is that Article 13(2) of Directive 2002/58, read in conjunction with Article 95 of the GDPR, must be interpreted as meaning that, where the controller uses the email address of a user in order to send him or her an unsolicited communication, in accordance with Article 13(2) of that directive, the conditions for lawful processing laid down in Article 6(1) of that regulation are not applicable.
The third question
70By its third question, the referring court asks whether Article 13(1) and (2) of Directive 2002/58 is to be interpreted as precluding national legislation which uses the concept of ‘commercial communication’, provided for in Article 2(f) of Directive 2000/31, instead of that of ‘direct marketing’, and, if not, whether a daily newsletter containing a summary of new legislation discussed in articles of an online publication, including hyperlinks to those articles, constitutes a ‘commercial communication’ within the meaning of Article 2(f) of Directive 2000/31.
71In that regard, it should be borne in mind that, according to settled case‑law, questions on the interpretation of EU law enjoy a presumption of relevance. The Court may refuse to give a ruling on a question referred for a preliminary ruling by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment of 15 June 2021, Facebook Ireland and Others, C‑645/19, EU:C:2021:483, paragraph 115 and the case-law cited).
72Moreover, according to equally settled case-law, the justification for a reference for a preliminary ruling is not that it enables advisory opinions on general or hypothetical questions to be delivered but rather that it is necessary for the effective resolution of a dispute (judgment of 15 June 2021, Facebook Ireland and Others, C‑645/19, EU:C:2021:483, paragraph 116 and the case-law cited).
73In the present case, it is apparent from the answer given to the first question and to point (a) of the fourth question that the communication of a newsletter such as that at issue in the main proceedings constitutes a communication ‘for the purposes of direct marketing’ within the meaning of Article 13(1) and (2) of Directive 2002/58. In those circumstances, it does not appear, on the basis of the information provided by the referring court, that that court also needs an interpretation of the concept of ‘commercial communication’, provided for in Article 2(f) of Directive 2000/31, in order to resolve the dispute before it.
74It follows that the third question is inadmissible.
Part (b) of the fourth question and the fifth question
75In view of the response given to the first question and to part (a) of the fourth question, there is no need to respond to part (b) of the fourth question and to the fifth question.
Costs
76Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
Operative part
On those grounds, the Court (First Chamber) hereby rules:
1.Article 13(1) and (2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009,must be interpreted as meaning that the email address of a user is obtained by the publisher of an online publication ‘in the context of the sale of a product or a service’, within the meaning of Article 13(2) of that directive, where that user creates a free account on that publisher’s online platform giving him or her the right to access, free of charge, a certain number of articles of that publication, to receive, free of charge, via email, a daily newsletter containing a summary of the new legislation discussed in articles within that publication, including hyperlinks to those articles, and the right to access, for a fee, additional articles and analyses of that publication. The transmission of such a newsletter constitutes a use of electronic mail ‘for the purposes of direct marketing’ for ‘similar products or services’ within the meaning of that provision.
2.Article 13(2) of Directive 2002/58, as amended by Directive 2009/136, read in conjunction with Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),must be interpreted as meaning that, where the controller uses the email address of a user in order to send him or her an unsolicited communication, in accordance with Article 13(2) of that directive, the conditions for lawful processing laid down in Article 6(1) of that regulation are not applicable.
3.The third question referred for a preliminary ruling by the Curtea de Apel București (Court of Appeal, Bucharest, Romania) is inadmissible.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.