Who is the data controller under data protection law when Advertising Is it sent via a mailing list provider? Is it the advertising company that defines the target audience, or the mailing list provider that selects the recipients and processes the address data? The Berlin Administrative Court had to address this question. The ruling (Case No.: 1 K 74/24) provides clarity for companies that conduct direct marketing through external lettershop service providers.
Regulatory Authority Issues a Warning
The plaintiff, the operator of a revue theater in Berlin, wanted to promote a show in late 2021 and, in doing so, also reach people who had not previously been customers.
To this end, she commissioned a mailing list provider to send out promotional letters using a lettershop service. The plaintiff merely defined the desired target group: people in Berlin and Brandenburg with above-average purchasing power.
The specific selection of recipients was made by the address broker using its own microcell model. The address data used came from the address broker’s database and was never disclosed to the plaintiff.
After a recipient of the Advertising Complaint After the plaintiff filed a complaint with the data protection authority, the authority issued a warning to the plaintiff. In the opinion of the Regulatory Authority the plaintiff and the address broker were jointly responsible for the Processing responsible for the personal data.
The plaintiff subsequently filed a lawsuit challenging the decision of the Regulatory Authority.
Who is responsible for the address data in the lettershop process?
The central issue in the proceedings was whether the plaintiff, together with the address broker, acted as Responsible persons within the meaning of Art. 4, No. 7, and Art. 26 GDPR could be seen.
According to GDPR Joint responsibility exists when multiple parties jointly determine the purposes and means of data processing.
The data protection authority argued that the plaintiff had influenced the data processing by specifying the target audience and was therefore jointly liable with the address broker.
However, the Berlin Administrative Court did not agree with this view.
Berlin Administrative Court Reverses Warning
The use of addresses is subject to the GDPR
First, the court clarified that the use of names and mailing addresses to send promotional letters is a Processing constitutes personal data.
Whether the formation and selection of the microcells themselves already constitute a Processing The court did not have to rule on whether this constituted the processing of personal data. The decisive factor was that specific address data was extracted and used for the mailing of the Advertising were used.
The plaintiff determined the purpose of the processing
In the court's view, the plaintiff did indeed influence the purpose of the Processing.
The advertising campaign was intended to attract new customers and thus directly served the company’s economic interests. The decision to contact potential new customers originated with the plaintiff.
However, this alone is not sufficient to establish joint liability.
The data processing was handled entirely by the list broker
The decisive factor for the court was that the plaintiff had no influence whatsoever on the specific details of the data processing.
The address broker decided on her own,
- how the microcells are formed,
- which statistical measures are used,
- how the recipients are selected,
- how the data is processed technically,
- and how shipping is organized.
The plaintiff merely purchased a service. By contrast, the technical, organizational, and data protection aspects of the entire process remained the sole responsibility of the address broker.
A clarification by the court is particularly important in this regard: The specification of general target audience characteristics does not, in this specific case, constitute participation in determining the means of data processing. Rather, it is part of the economic objective of the advertising campaign.
ECJ case law is not applicable
The Berlin Administrative Court examined in detail several rulings by the European Court of Justice, including those concerning fan pages, social media plugins, and digital advertising systems.
From the court's perspective, the following distinction was decisive:
In previous ECJ cases (e.g., judgment of July 29, 2019—C-40/17—Fashion ID), the parties involved typically had influence not only over the purpose but also over the technical or organizational means of data processing. In some cases, they made data collection possible in the first place or actively helped shape the processing procedures.
The situation was different in the lettershop process.
The address broker already had access to its database independently of the plaintiff’s order and was able to use it on its own. In contrast, the plaintiff did not grant access to personal data nor did it create any technical infrastructure for its Processing. It simply took advantage of an existing business model.
The court therefore held that merely initiating the advertising campaign was not sufficient to establish joint liability.
Ruling Is Not a Free Pass for Direct Marketing
Nevertheless, the practical significance of the decision should not be overestimated.
The court expressly did not examine whether the specific advertising measure was permissible under data protection law. Nor did it rule on whether the address broker had lawfully processed the personal data.
In particular, the following questions remain unanswered:
- Can the Processing pursuant to Art. 6(1)(f) GDPR be supported?
- If the balancing of interests favors the Advertising out?
- Were the Duty to inform pursuant to Article 14 GDPR Fulfilled?
- Is the specific lettershop process, as a whole, GDPRDesigned to be compliant?
The ruling therefore addresses solely the issue of liability under data protection law.
Following the Lettershop Ruling: What Companies Should Review Now
For companies that work with address brokers or lettershop service providers, this decision provides important guidance.
In particular, the following should be documented:,
- what role the service provider plays,
- who decides on selection methods and procedures,
- whether the advertising company has access to personal data receives,
- what opportunities there are to influence the Processing actually exist,
- and who determines the technical and organizational processing procedures.
The more closely a client is involved in the specific arrangements for data processing, the more likely it is that joint responsibility under Art. 26 GDPR be considered.
This decision does not relieve companies of the obligation to carefully review their marketing processes. In particular, the legal basis for the Processing, the fulfillment of the Duty to inform pursuant to Article 14 GDPR and the classification of each service provider under data protection law must continue to be assessed on a case-by-case basis.
Important Ruling on the Interpretation of Joint Liability
The Berlin Administrative Court draws an important line in interpreting joint liability under Article 26 GDPR.
Simply specifying an advertising purpose and general target audience parameters is not sufficient to make an advertising company, together with a data broker, a data controller. Rather, what is required is actual influence over the organizational, technical, or methodological means of data processing.
The ruling thus clarifies the allocation of responsibility, but does not answer the question of whether such advertising practices substantively meet the requirements of the GDPR is sufficient. This question remains open.
Source: Berlin Administrative Court, Judgment of October 14, 2025 (Case No.: 1 K 74/24)
Support for Marketing Processes That Comply with Data Protection Regulations
The Berlin Administrative Court’s decision shows that the division of roles under data protection law among advertising companies, address brokers, and other service providers must be carefully examined. At the same time, key questions remain regarding the legal basis for the Processing, to the Duty to inform as well as on the design of direct marketing measures in compliance with data protection regulations.
2B Advice helps companies ensure that their arrangements are legally sound Marketing- and sales processes: from determining the data protection status of the parties involved to reviewing Legal basis including the implementation of information and documentation requirements in accordance with GDPR.
Would you like to have your direct marketing processes reviewed for compliance with data protection laws? Our data protection and Compliance-Our experts will be happy to advise you
Frequently Asked Questions
What does the Berlin Administrative Court’s ruling mean for lettershop procedures under the GDPR?
The ruling by the Berlin Administrative Court shows that an advertising company is not automatically jointly liable with a data broker simply because it specifies a target group for a direct marketing campaign. The decisive factor is who actually controls the organizational, technical, and methodological means of data processing. In this specific case, that decision rested entirely with the address broker.
When does joint liability under Article 26 of the GDPR apply in a lettershop process?
Joint liability under Article 26 GDPR is a possibility when several parties jointly decide on the purposes and means of a Processing decide. In a lettershop process, the business decision to launch an advertising campaign alone is not sufficient. What matters is whether the client has influence over selection methods, data sources, technical Processing, shipping arrangements, or the selection of specific recipients.
Is specifying a target group sufficient to qualify as a joint controller?
No, according to the Berlin Administrative Court’s ruling, simply specifying general target group characteristics is not sufficient in this specific case. If a company defines only a target group—such as a region, purchasing power, or customer segment—but does not have access to address data and the specific selection as well as Processing If the data is held entirely by the address broker, this argues against joint liability.
Is direct marketing through address brokers automatically GDPR-compliant following the ruling?
No. The ruling only clarifies the issue of liability under data protection law between the advertising company and the address broker. It does not definitively answer whether the specific advertising measure itself GDPR...compliant. Companies must continue to ensure a legal basis, a balancing of interests, Duty to inform pursuant to Article 14 GDPR and review the actual structure of the procedure.
What should companies document before hiring a lettershop service provider?
Companies should document what role the lettershop service provider plays, who decides on selection methods, and whether the company has access to personal data receives, which provides opportunities to influence the Processing exist and who manages technical and organizational processes. These Documentation helps define the division of roles according to GDPR to evaluate in a transparent manner.
Who helps companies conduct GDPR compliance reviews of direct marketing, address brokers, and lettershop processes?
2B Advice assists companies in conducting data protection reviews of their direct marketing and sales processes. This includes identifying the parties involved, assessing who is the data controller or joint controller, and reviewing Legal basis, Duty to inform and documentation requirements, as well as the legally compliant structuring of marketing processes in accordance with GDPR.
German 
English 
Italian 
French