The European Court of Justice (ECJ), in its judgment of 13 November 2025, C-654/23 fully aligned itself with the legal assessment of the Advocate General: Even in the case of seemingly gratuitous offers – such as the creation of a free user account – there may already be a “sale of a service” within the meaning of Art. 13(2) ePrivacy Directive. If the provider subsequently sends a newsletter advertising new content on the website, this constitutes direct marketing within the meaning of the ePrivacy Directive.
New standard: What the ECJ understands by "sale" – Indirect remuneration is sufficient even in the case of gratuitous offers
Of note and practical importance is the interpretation of the term "sale" by the ECJ. The Court makes it clear that this term does not require the user to make a direct monetary payment. An "indirect remuneration" is enough: it suffices if an account provided to the user free of charge (e.g. “Service Premium”) is primarily used for advertising purposes, to induce the user to subscribe to a paid service. According to the Court, it is decisive that by creating an account, a legal relationship between the customer and the provider is established and the user enters into this relationship by consenting to the terms of use. The ECJ also expressly recognises that the costs of the free offer are economically incorporated into the price of the paid product – in this case, the full subscription – and therefore constitute indirect remuneration. Under these circumstances, the requirement of a "sale" is already fulfilled. In this way, the ECJ significantly broadens the interpretation and scope of Article 13(2) of the ePrivacy Directive.
However, the judgment leaves unresolved how far this understanding of the term extends to other scenarios. The Court leaves open whether any form of registration – for example, on purely informational, completely free platforms without upselling, advertising intent or economic benefit for the operator – is already to be regarded as a “sale”. It therefore remains to be seen whether such non-commercial offers will also be covered by this broad interpretation of the term, or whether a specific economic interest of the provider will always be required. There remains scope for further clarification through case law and legislation.
Is a newsletter “direct advertising”? The ECJ clarifies: The decisive factor is the purpose—not merely the content
In its judgment, the ECJ explicitly examined whether the "Personal Update" newsletter should be classified as "direct advertising“, as the company (Inteligo) argued that the dispatch primarily served editorial and informational purposes. However, the Court clarified that it is not solely the content that is decisive, but rather the purpose (“finality”) of the communication.
Although the newsletter contains informative summaries of new laws, its actual purpose, according to the ECJ, is to direct the user via hyperlinks to the platform. There, the user is meant to exhaust their quota of free articles and be encouraged to take out a paid full subscription. The ECJ expressly highlights the commercial objective behind the format and classifies such communications – regardless of their journalistic-informative content – as "direct marketing" within the meaning of Art. 13 ePrivacy Directive. The decisive factor is thus the sales promotion purpose of the dispatch.
No legal basis under the GDPR required: The ePrivacy Directive acts as lex specialis
The ECJ confirms that no prior consent is required for sending such a newsletter, provided that the requirements of Art. 13(2) ePrivacy Directive are met – in particular, that a clear indication of use for marketing purposes and a simple and free possibility for the user to object are in place.
The ECJ also clarifies the question of whether a company that relies on the so-called "soft opt-in" (Art. 13(2) ePrivacy Directive) must additionally demonstrate a legal basis under Art. 6 GDPR – for example, legitimate interests pursuant to Art. 6(1), first subparagraph, point (f) GDPR. The Court expressly confirms the "lex specialis" effect of the ePrivacy Directive, which is by Art. 95 GDPR: Where the ePrivacy Directive lays down specific obligations and conditions for the processing of personal data, these provisions override the general rules of the GDPR in the relevant area of application.
Art. 95 GDPR clarifies that the GDPR does not impose any additional obligations where specific obligations with the same objective are already provided for in the ePrivacy Directive. Accordingly, the ECJ states that Art. 13(2) ePrivacy Directive serves as an independent and exhaustive legal basis for the sending of marketing emails. If the soft opt-in is permitted – in particular where there is a notice regarding use for marketing purposes and a free opportunity to object at any time – the processing is lawful. An additional review under the GDPR, especially pursuant to Art. 6(1) GDPR, is not required.
With its decision, the ECJ contradicts the previously often held view that, in addition to a legal basis under the ePrivacy Directive, another one under the GDPR is always required. For practical application, however, this aspect is less revolutionary, as it has already generally been assumed that, where the exception under Art. 13(2) ePrivacy Directive applies, the data processing is regularly justified by the legitimate interest pursuant to Art. 6(1) first subparagraph (f) GDPR. Therefore, in practice, no additional GDPR consent was required. While the judgment does bring clarity, it only opens up new scope for action to a limited extent.
Does the judgment also provide relief with regard to the consent requirement?
For future developments, the question may be of particular interest as to whether the precedence of Art. 13(2) of the ePrivacy Directive over the GDPR, as confirmed by the ECJ, also applies to Art. 13(1) – that is, to situations in which a requirement for consent exists.
If the ECJ were to assume in this case as well that the ePrivacy Directive, as lex specialis, conclusively regulates the requirements for consent, this would have remarkable consequences: additional consent pursuant to Art. 6(1) first subparagraph, point (a) GDPR would then not be required. For companies, this would represent a significant relief, as the strict substantive requirements of the GDPR for consent (transparency, demonstrability, prohibition of tying, instruction on withdrawal, etc.) would not have to be met in addition. The requirements for valid consent in this area would therefore be considerably lower and governed exclusively by the ePrivacy Directive. Whether the ECJ will continue to follow this approach remains to be seen – however, the judgment provides initial indications of a possible future extension of the lex specialis principle.
Practical note
Companies that send newsletters on the basis of free user accounts may in future rely on this ECJ judgment. However, all requirements of Article 13(2) of the ePrivacy Directive (in Germany, Section 7(3) UWG) must still be complied with:
- Is there a (possibly indirectly remunerated) customer relationship?
- Can the promoted services be classified as "similar" services?
- Was the opt-out notice, provided during data collection, clearly and comprehensibly formulated?
- Is the reference to the opt-out procedure included in every email?
Background of the case
In the present case, the Romanian data protection authority imposed a fine due to the absence of consent under the GDPR in connection with the dispatch of a newsletter. The European Court of Justice – in accordance with the Advocate General’s opinion – rejected the necessity of such consent.
To the discussion of the Advocate General's Opinion
