Precedent corpus / CNIL (France)
Undisclosed loyalty-programme operator (anonymised by CNIL)
CNIL (France) case SAN-2025-017, decided . EUR 3.5M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
The deciding authority did not name this party. The designation above is the authority's own. This corpus does not restore a name a regulator declined to publish.
What the regulator decided
A loyalty-programme operator transmitted members' email addresses and phone numbers to a social network for custom-audience advertising from 2018 without valid consent for that transmission - the sign-up form gave no information about it, so the consent collected for prospecting could not extend to matching the list against an advertising platform - breaching Articles 6, 12-13, 32 and 35 GDPR and Article 82 of the French Data Protection Act.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanctionArchived snapshot
Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.
https://web.archive.org/web/20260403223236/https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanctionConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
The on-point authority for CRM-list upload governance (Google Customer Match, Meta Custom Audiences): consent to email/SMS prospecting does not cover matching the list against an ad platform - that transmission needs specific, explicitly-worded consent naming it and its purpose. Pairs with SAN-2023-009 (Criteo) on upstream consent never being assumable.
Verification trail
Checked against the primary source on 16th August 2026. Next review 16th February 2027.
Cite this case
@misc{consentmark-precedent-cnil-san-2025-017,
author = {{ConsentMark}},
year = {2025},
title = {CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL)},
howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2025-017}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, December 30). CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL). Methodology v7.8.1. https://www.consentmark.com/precedent/cnil-san-2025-017[CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL) - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2025-017)CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL) - ConsentMark, 2025-12-30, methodology v7.8.1, https://www.consentmark.com/precedent/cnil-san-2025-017