Aristotelis Zervos
Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in data protection, IT compliance and AI regulation.
In its judgment C‑654/23, the European Court of Justice (ECJ) provides clear Guidelines on the interpretation of the term „direct marketing“ within the meaning of the ePrivacy Directive and on the relationship between the ePrivacy Directive and the GDPR. In particular, the ECJ clarifies under which conditions the sending of newsletters to email addresses collected in the context of free user accounts is permissible and when no separate Consent is required. What practical consequences the ECJ ruling has for companies.
Free account and newsletter without consent
The case concerned the Romanian online platform avocatnet.ro, which provides legal news. Inteligo Media SA, the platform operator, initially allowed users to read up to six articles per month free of charge. To access additional free content, users could create a free account, for which they had to provide their email address. By setting up this free account, users gained access to two extra articles per month and a daily email newsletter called „Personal Update.“ When registering, they could explicitly opt out of receiving the newsletter. Each newsletter also contained an unsubscribe link so that users could cancel their subscription at any time.
The Romanian National Supervisory Authority for Personal Data Protection (ANSPDCP) considered this to be a Infringement Violation of data protection law: Inteligo Media used the collected email addresses for another purpose, namely direct advertising via newsletters, without obtaining express consent. Consent the user. A Fine of approximately €9,000. Inteligo Media denied the allegation and argued that it had acted in accordance with the ePrivacy Directive and therefore did not require any additional GDPR legal basis such as a Consent Finally, the Romanian Court of Appeal referred several questions to the ECJ. These included the definition of „direct marketing,“ the interpretation of „in connection with the sale of a product or service“ (Art. 13(2) ePrivacy Directive), and the application of the GDPR (Art. 6 and Art. 95 GDPR) in this context.
When is a newsletter considered direct advertising?
A key issue was whether the daily newsletter should be classified as „direct marketing“ within the meaning of the ePrivacy Directive. Inteligo Media argued that the newsletter primarily served to provide information about new legislative changes and was editorial in nature. However, the ECJ clarified that it is not only the content but above all the purpose of the message that is decisive. Although the Personal Update newsletter contained informative summaries, it ultimately pursued a commercial goal: to lead users back to the website via links so that they could use up their free limit and be encouraged to purchase a full subscription. This constitutes individual advertising aimed at users. The ECJ confirmed that such emails "for the purposes of direct marketing,“ even if they appear to be editorial content at first glance.
Conclusion: Companies are permitted to send newsletters with „mixed“ content (information plus hidden Advertising) are considered direct advertising under data protection law. The decisive factor is the sales-promoting purpose of the message, not merely its superficial content.
Free user account = „sale of a service“?
Of particular practical relevance is the question of whether creating a free account can be considered „in connection with the sale of a product or service“ (Art. 13(2) ePrivacy Directive). This definition determines whether the „soft opt-in“ exception applies, which allows direct marketing without prior Consent permitted. The ECJ expressly affirms this: even an apparently free service can constitute a „sale“ if the user provides their data in exchange. The decisive factor is that the creation of an account establishes a contractual relationship between the user and the provider and that the provider receives an indirect economic benefit. In the present case, the „indirect payment“ consisted in the fact that the free offer was intended to promote sales of the paid premium subscription. The ECJ emphasizes that the costs of the free service are economically factored into the price of the paid offer and thus constitute indirect remuneration.
With this broad interpretation, even the free account fulfills the requirement of a „sale“ within the meaning of Art. 13(2) of the ePrivacy Directive. Companies with freemium models can therefore consider their free users as „customers“ within the meaning of the ePrivacy Directive and send them newsletters as part of their own offering without prior opt-in, provided that the other conditions are met. The only thing that remains unclear is how far this interpretation extends. The ECJ left open whether purely free services without any intention of upselling also qualify as „sales“ or whether there must always be an economic self-interest on the part of the provider. In practice, however, companies should assume that data in exchange for services corresponds to a payment-like exchange – „paying with data“ is recognized as a real business model.
ePrivacy vs. GDPR: No dual legal basis required (lex specialis)
The ECJ's clarification of the relationship between the ePrivacy Directive and the GDPR. Article 95 GDPR states that the GDPR no additional obligations are imposed if specific provisions with the same objective exist in the ePrivacy Directive for certain areas (such as electronic communications). The ECJ now expressly confirms the lex specialis principle in this context: if a data processing operation fulfills the specific conditions of the ePrivacy Directive, there is no need to resort to the general legal bases of the GDPR (Art. 6 (1)). In plain language: Art. 13 (2) of the ePrivacy Directive constitutes an independent and conclusive legal basis for sending direct marketing emails. If all the conditions specified therein are met—such as the option to opt out and a similar product—the following applies: Processing as lawful. A separate review pursuant to Art. 6 GDPR (e.g. on legitimate interests) is not necessary.
The ECJ thus contradicts the previously widespread view that, in addition to the ePrivacy exception, a GDPR permission requirement (often Art. 6(1)(f) GDPR, legitimate interest, endeavored). In practical implementation, many companies had already opted for a separate Consent waived and instead accepted the legitimate interest. The ruling clarifies that the soft opt-in rule as such provides the necessary authorization. Important: This does not mean that the GDPR does not apply in any case. All other obligations (e.g. Duty to inform, Data security, Rights of data subjects) still apply, of course. However, there is no longer any need to have a GDPR legal basis (such as Consent or LI).
Reading tip: Personal data and pseudonymization – ECJ clarifies requirements
Newsletters without consent: What needs to be considered in the future?
In principle, the ePrivacy Directive requires prior consent for unsolicited electronic communications for advertising purposes. Consent the recipient (opt-in, Art. 13(1) ePrivacy Directive). However, Art. 13(2) ePrivacy Directive contains the well-known exception („soft opt-in“) for advertising to existing customers, which is implemented in German law in Section 7(3) UWG, for example. The ECJ ruling now clarifies how this exception is to be applied and emphasizes the strict conditions for it:
- Customer relationship: A customer relationship must exist, including indirectly remunerated relationships such as in the freemium model. A free user account can therefore be considered a „customer“ if it is part of a business exchange of services (e.g., access in exchange for data).
- Similar product/service: The Advertising may only refer to its own similar products or services. In the Inteligo case, the newsletter focused on content from its own platform, which falls under similar services. However, anyone wishing to advertise third-party or completely different products cannot rely on this exception.
- Opt-out for data collection: At the time of data collection (e.g., when creating an account), the customer must have been given a clear and unambiguous opportunity to object to the use of their email address. In this specific case, this was done by means of an opt-out checkbox labeled „I do not wish to receive the newsletter.“ This opt-out option must be free of charge and easy to use.
- Opt-out in every messageEvery promotional email sent must contain a clear reference to the option to opt out (unsubscribe link). Recipients must be able to unsubscribe easily at any time.
Only if all these conditions are met may a newsletter be sent without prior opt-in consent. If one of the conditions is not met, for example because the advertised content can no longer be classified as „similar“ or because no opt-out opportunity was given during the initial contact, the exception does not apply. In such cases, explicit consent must be obtained before sending the newsletter. Consent of the user, which must meet the strict GDPR criteria (voluntary, informed, verifiable, etc.).
Practical consequences for companies
The ECJ ruling has practical implications for the design of newsletter subscriptions and marketing strategies. Companies should now review their processes and adapt them if necessary:
- Using freemium models in a legally compliant manner: Companies with free user accounts or „freemium“ offers can now make use of soft opt-in with greater legal certainty. Use email addresses from free registrations for direct advertising of your own premium offers without separate Consent. But only if the opt-out conditions have been met. Make sure that there is a clear reference to the newsletter when registering and that it is possible to opt out.
- Similarity check of the Advertising: Check whether your planned advertising content really only relates to your own similar products/services. Advertising for non-specialized products, third-party offers, or completely new services offered by the company is not covered by the exception and requires Consent. Keep marketing content closely related to the product originally purchased.
- Consistently implement opt-out: Document the opt-out options in your systems. Every promotional email should contain a clearly visible unsubscribe link. This also promotes customer trust. Check regularly to ensure that unsubscriptions are implemented reliably from a technical standpoint.
- No hidden coupling: Refrain from offering newsletters covertly as part of a „mandatory package.“ If you Consent must obtain (because soft opt-in does not apply), this must not be linked to account use. Users must be able to use the free service even if they reject the newsletter, otherwise the Consent ineffective (Prohibition of tying).
- Transparency in privacy policies: Adjust your privacy policy and customer information. Clearly explain the purposes for which you will use the email address (e.g., sending a free newsletter about similar offers) and that the user can object to this at any time. This underscores your Compliance and informs those affected in accordance with Art. 13 GDPR.
- Documentation the legal basis: Keep track of the basis on which you send newsletters. Can you rely on Section 7 (3) UWG / Art. 13 (2) ePrivacy Directive (soft opt-in), or is there a Consent A clean Documentation helps to prove that your practice complies with current legal requirements.
Conclusion: Newsletters without consent under strict conditions
The ECJ ruling C‑654/23 Inteligo Media provides welcome clarity for companies: The ePrivacy Regulation on E-mail marketing is lex specialis and allows newsletters to be sent without prior opt-in under strict conditions. Objectives are classified as direct advertising, even if their content is primarily informative.
Companies would be well advised to adapt their newsletter processes now: anyone who wants to take advantage of the soft opt-in exception must comply with all requirements. Otherwise, an explicit Consent the recipient. Overall, the ruling strengthens practical approaches in direct marketing and takes into account the reality of „free“ online services. For data protection officers and decision-makers, this means greater legal certainty when designing E-mail marketing, However, care must be taken to maintain user trust and avoid legal risks.
German 
English 
Italian 
French