Undisclosed loyalty-programme operator (anonymised by CNIL)

CNIL (France) case SAN-2025-017, decided 2025-12-30. EUR 3,500,000.

What the regulator decided

A loyalty-programme operator transmitted members' email addresses and phone numbers to a social network for custom-audience advertising from 2018 without valid consent for that transmission - the sign-up form gave no information about it, so the consent collected for prospecting could not extend to matching the list against an advertising platform - breaching Articles 6, 12-13, 32 and 35 GDPR and Article 82 of the French Data Protection Act.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanction

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20260403223236/https://www.cnil.fr/fr/transmission-de-donnees-un-reseau-social-des-fins-publicitaires-sanction

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

The on-point authority for CRM-list upload governance (Google Customer Match, Meta Custom Audiences): consent to email/SMS prospecting does not cover matching the list against an ad platform - that transmission needs specific, explicitly-worded consent naming it and its purpose. Pairs with SAN-2023-009 (Criteo) on upstream consent never being assumable.

Verification trail

Verified by: donal
Verified at: 2026-08-16
Review due: 2027-02-16

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-cnil-san-2025-017,
  author       = {{ConsentMark}},
  year         = {2025},
  title        = {CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL)},
  howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2025-017}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2025, December 30). CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL). Methodology v1.3. https://www.consentmark.com/precedent/cnil-san-2025-017

Markdown

[CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL) - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2025-017)

Plain text

CNIL (France) SAN-2025-017 - Undisclosed loyalty-programme operator (anonymised by CNIL) - ConsentMark, 2025-12-30, methodology v1.3, https://www.consentmark.com/precedent/cnil-san-2025-017