Introduction
Inteligo Media is a website offering daily updates on Romanian legislative developments. Most articles are free, but users hit a paywall after six views a month. Creating a free account unlocks two more articles and a newsletter, a summary of new legislation with links back to the platform. No one pays for this free account. No one explicitly consents to marketing, but the platform does send thousands of these newsletters each day. This looked like an open-and-shut case about consent for direct marketing.
The Romanian DPA thus fined the company for lacking GDPR-grade consent. Inteligo Media argued that this wasn’t even marketing, it was editorial content. And even if it was marketing, the soft opt-in under art. 13(2) ePrivacy Directive applied.
The interpretation and interplay of the lex specialis ePrivacy Directive and lex generalis GDPR was refered to the EU Court of Justive (CJEU).
Soft opt-in exception explained
What exactly is the soft opt-in exception again you might ask?
As a rule, Article 13(1) of the ePrivacy Directive requires prior consent for any unsolicited electronic communications e.g. direct marketing. Article 13(2) introduces a limited derogation, often labelled the “soft opt-in”, which provides a basis for legitimate interest to send direct marketing but only if the following requirements are met:
- The contact details were obtained in the context of a sale of goods or services.
- You contact the customer for your own similar products or services.
- You inform the customer about your legitimate interest to contact them and always provide an opt-out
Inteligo media case explained
The CJEU dives deeper in the following aspects of the ePrivacy Directive:
- Does a newsletter constitute direct marketing?
- Can a sale be free?
- What is the applicable legal basis if you rely on the soft opt-in?
Is a newsletter direct marketing?
The CJEU states that a newsletter is not purely editorial content, even if it has substantive information. The effect and structure of the newsletter is promotional outreach. It drives users toward paid content or the services offered by the controller. This suffices to classify newsletters as “direct marketing.”
Even “informative” emails can be marketing if they function to steer users toward the commercial offering. The trigger is the purpose and effect, not whether the message looks like an ad.
This interpretation follows settled case law and does not offer new insights.
Can a sale be free?
As one of the elements to rely on the soft opt-in exception is the ‘sale of goods/services’, it was unclear whether a free offering such as downloading an e-book or participating in a free webinar constitutes a sale.
The CJEU clarifies and broadens the scope of what constitutes a sale to indirect numeration:
- free registration where the primary purpose is commercial,
- where user data or engagement indirectly contribute to the business model, or
- where free access is part of a freemium upselling
As such, downloading an ebook or participating in a free webinar can fall under one (or more) of these purposes and thus constitutes a sale for the soft opt-in exception.
The logic is that free ≠ non-commercial. There is a commercial transaction with economic relevance.
Legal basis
In the past, the common logic was that either you rely on consent for direct marketing, or you apply the soft opt-in exception and thus rely on your legitimate interest to send direct marketing.
The CJEU objects to this logic since art. 95 GDPR foresees that the GDPR should not impose additional obligations where sector-specific rules (like ePrivacy) already provide specific obligations with the same objective. As such, if you comply with the ePrivacy Directive for legal basis, you do not need to look for an additional legal basis in the GDPR since the ePrivacy Directive overrules the GDPR.
The outcome is that if you comply with all soft opt-in requirements as stated above, you have your legal basis under the ePrivacy Directive for the sending of direct marketing. The processing is lawful because it complies with Article 13(2), not because it fits into one of the GDPR’s legal bases.
Key Takeaways.
- Newsletters = direct marketing. Even if they’re “informative”, their purpose and effect define them, not the format or tone.
- Free ≠ non-commercial. Free accounts, downloads, or webinars can count as a “sale” under the soft opt-in rule.
- Soft opt-in applies. If you meet all ePrivacy requirements, you don’t need a separate GDPR legal basis.
- ePrivacy Directive overrules GDPR when it comes to direct marketing, Article 13(2) takes precedence over Article 6 GDPR.
- Clearer rules, less admin. Legitimate interest assessments aren’t needed when soft opt-in conditions are met; a welcome simplification.
Conclusion
For once, a court case is exceedingly clear and applicable. To rely on the soft opt-in exception, a sale of goods/services can also be a free offering as it indirectly contributes to a business model. On top of that, for the purpose of sending direct marketing, no additional legal basis must be sought under the GDPR as the ePrivacy Directive overrules the GDPR in such a case. This reduces the administrative burden on companies to conduct legitimate interest assessments to send direct marketing based on the soft opt-in exceptions. Since the European Commission is looking to simply the GDPR (and thus by extension, the ePrivacy Directive), this is a welcome change.
However, for any further processing which does not fall under the direct marketing purpose, the GDPR does come into play again e.g. for analytics, profiling, etc. You must still adhere to the processing This is only natural, as the scope of the ePrivacy Directive is limited whereas the GDPR’s scope is very broad.
