News from the ECJ on the use of email addresses for advertising purposes

On November 13, 2025, the European Court of Justice (ECJ) (judgment of November 13, 2025 – Case C-654/23) clarified the rules for sending newsletters to existing customers.

The subject of the decision was the interpretation of Art. 6 (1) GDPR and Art. 13 (1) and (2) of the Privacy and Electronic Communications Directive (Directive 2002/58/EC, also known as the ePrivacy Directive), which provides for an exception to the general requirement of consent for direct marketing to existing customers. In Germany, this so-called existing customer privilege (“opt-out” solution) is implemented in Section 7(3) of the Unfair Competition Act (UWG). It is therefore permitted to send direct marketing for similar products or services to a person or company if the person has provided their email address as a customer in connection with the sale of a product or service. The person must be given a clear and unambiguous opportunity to refuse such use of their email address at the time of collection and at any time thereafter, free of charge and without difficulty. This requirement is regularly implemented via a link to revoke consent at the end of each email. As a result, sending a newsletter to existing customers does not violate the GDPR or the UWG, even without consent.

Background to the decision

The publisher of a Romanian online press medium provided the general public with free information on its website about the daily changes to the law in Romania. In 2018, the company introduced a paid subscription system (“premium service”) for users who wanted to read more than the free articles published on the website. In order to access the additional articles, users first had to set up a free account on the online platform and accept the terms of use for the premium service. When registering using the online form, users were free to choose whether or not to subscribe to the “Personal Update” newsletter. Similarly, users who no longer wished to receive this newsletter could click on the “UNSUBSCRIBE” button in the newsletter each time they received it.

In September 2019, the Romanian Supervisory Authority for Personal Data Processing (ANSPDCP) imposed a fine of approximately €9,000 for violations of Art. 5(1)(a) and (b), Art. 6(1)(a), and Art. 7 GDPR. The ANSPDCP considered that the necessary explicit consent of 4,357 users to the processing of their personal data (email, password, username) could not be proven and that the data had been processed in a manner incompatible with the purpose for which it had originally been collected. The company lodged an appeal against this decision and took the case through the courts. The Bucharest Court of Appeal referred several questions to the ECJ for a preliminary ruling, as it was unclear whether the email addresses collected as part of the free user account allowed the company to engage in direct marketing within the meaning of Article 13(2) of Directive 2002/58 and whether sending the “Personal Update” newsletter by email fell within the scope of direct marketing at all.

The ECJ clarified, on the one hand, that the “Personal Update” newsletter pursues a commercial objective and is therefore carried out “for the purposes of direct marketing” within the meaning of Art. 13 (1) and (2) of Directive 2002/58. On the other hand, the free user account also falls under the term “sale of a service” within the meaning of Article 13(2) of Directive 2002/58, since subscribing to the premium service not only gave the right to free access to a certain number of articles, but the premium service was primarily intended to serve the advertising purpose of promoting other paid content. The company included the free articles in the price of the premium service, which corresponds to indirect payment. Furthermore, the ECJ found that the conditions for the lawfulness of processing set out in Article 6(1) of the GDPR do not apply if the controller uses a user's email address to send them emails within the scope of Article 13(2) of Directive 2002/58.

Conclusion

As a result, the requirements for advertising to existing customers remain the same, but the ECJ has interpreted the term “sale” in a surprisingly broad and “advertising-friendly” manner.

The ECJ ruling creates greater scope in the area of email marketing for existing customers. For example, registering for a free account on an online platform may be sufficient to send direct advertising by email under the so-called existing customer privilege. This is because even a free account establishes the necessary prior customer relationship (“sale of a service”). Section 7 (3) UWG then applies even without an order or purchase. And if the existing customer privilege under Section 7 (3) UWG applies in Germany, the GDPR is not applicable, which means that the data protection authorities are no longer responsible in this case. Although the fundamental risk of competition law warnings remains, companies can reassess and, if necessary, expand their options for electronic direct advertising in light of the decision.