{"id":101135,"date":"2025-11-13T12:59:33","date_gmt":"2025-11-13T11:59:33","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=101135"},"modified":"2025-11-13T17:23:57","modified_gmt":"2025-11-13T16:23:57","slug":"are-you-allowed-to-send-direct-marketing-to-users-with-a-free-account","status":"publish","type":"post","link":"http:\/\/www.ictrechtswijzer.be\/en\/mag-u-direct-marketing-sturen-naar-gebruikers-met-een-gratis-account\/","title":{"rendered":"Are you allowed to send direct marketing to users with a free account?"},"content":{"rendered":"

A ruling by the European Court of Justice brings important news for any company working with \u2018freemium\u2019 models or free accounts. In the ruling Inteligo Media<\/em> (C-654\/23)<\/a> of 13 November 2025, the Court confirmed that an e-mail address obtained through a free account may indeed be used for direct marketing.<\/p>\n\n\n\n

The condition is to meet the \u2018soft opt-in\u2019 exception from the ePrivacy Directive<\/a>. Important: if these conditions are met, no separate legal basis (such as consent or legitimate interest) is required under the General Data Protection Regulation (GDPR)<\/a> .<\/p>\n\n\n\n

The facts: a free account and an automatic newsletter<\/h2>\n\n\n\n

The case revolved around Inteligo Media, the publisher of the Romanian legal news website avocatnet.ro<\/sup>. This website used a \u2018freemium\u2019 model:<\/p>\n\n\n\n

    \n
  1. A visitor could read 6 articles per month for free.<\/li>\n\n\n\n
  2. To read more (free) articles, the user had to create a free account. This required an e-mail address.<\/li>\n\n\n\n
  3. When creating that account, the user also received access to 2 additional free articles as well as a daily newsletter (\u201cPersonal Update\u201d).<\/li>\n\n\n\n
  4. This newsletter contained summaries of new articles, with hyperlinks leading to the website, where users were then faced with a pay wall for the full \u2018premium\u2019 content.<\/li>\n\n\n\n
  5. Importantly, users could unsubscribe immediately upon registration (via an opt-out box) and each newsletter contained a clear unsubscribe link.<\/li>\n<\/ol>\n\n\n\n

    The Romanian Data Protection Authority (ANSPDCP) fined the company approximately \u20ac9,000. The regulator's reasoning was that Inteligo Media had collected the email addresses for one purpose (executing the \u2018free account\u2019 agreement) but then unlawfully used them for another purpose (direct marketing), without having the required consent under the GDPR.<\/p>\n\n\n\n

    The decision of the Court of Justice<\/h2>\n\n\n\n

    The Romanian court referred preliminary questions to the Court of Justice. The Court had to answer essentially three questions:<\/p>\n\n\n\n

      \n
    1. Is this newsletter \u201cdirect marketing\u201d?<\/strong>

      Yes.<\/strong> The Court held that even though the newsletter is informative in nature (summaries of news), its ultimate purpose is commercial: to encourage users to reach the free article limit and take out a paid subscription.

      <\/li>\n\n\n\n
    2. Is creating a free account a \u201csale of a product or service\u201d?<\/strong>

      Yes.<\/strong> This is the crux of the ruling. The Court states that an email address obtained when creating a free account, which provides access to free content and offers the option of paid content, was indeed obtained \u201cin the context of the sale of a product or service.\u201d The \u201cpayment\u201d here is indirect: the promotion of the paid service.

      <\/li>\n\n\n\n
    3. If the ePrivacy rules are met, is a separate GDPR legal basis still needed?<\/strong>

      No.<\/strong> The Court confirms that the ePrivacy Directive is a lex specialis (a more specific law). If the processing meets the specific conditions of \u201csoft opt-in\u201d (Article 13(2) of the ePrivacy Directive), the general conditions of lawfulness from Article 6(1) of the GDPR do not apply.

      The Court relies on Article 95 of the GDPR, which states that the GDPR does not impose additional obligations where the ePrivacy Directive already provides specific rules. The Court finds that Article 13(2) (the soft opt-in) is such a specific rule. It is a stand-alone legal ground that replaces the application of Article 6(1) GDPR (with its list of legal grounds such as consent, agreement, legitimate interest, etc.).<\/li>\n<\/ol>\n\n\n\n

      Legal analysis and interpretation<\/h2>\n\n\n\n

      This ruling has direct implications for Belgian legal practice and corrects the recent recommendation of our own Data Protection Authority (GBA).<\/p>\n\n\n\n

      1. ePrivacy as \u2018lex specialis\u2019<\/h3>\n\n\n\n

      The GDPR regulates general data processing, but the ePrivacy Directive is a lex specialis (specific law) for electronic communications.<\/p>\n\n\n\n

      In Belgium, the view of the GBA, as recently expressed in its Recommendation 01\/2025<\/a>, was that the \u2018soft opt-in\u2019 (Art. 13(2) ePrivacy) found its legal basis in \u2018legitimate interest\u2019 (Art. 6.1.f GDPR). This implied that, in addition to the soft opt-in conditions, a company had to carry out an additional balancing of interests.<\/p>\n\n\n\n

      The Inteligo Media<\/em> corrects this view.<\/strong> The Court clearly states that when the conditions of Art. 13(2) ePrivacy are met, it is an autonomous legal ground and the legal grounds in Article 6(1) GDPR (including \u2018legitimate interest\u2019) do not apply. <\/p>\n\n\n\n

      Moreover, the scope of this \u2018lex specialis\u2019 reasoning is likely to be much broader than just direct marketing. As the EDPB (the European Data Protection Board) already indicated in 2019 (Opinion 5\/2019<\/a>), this ruling implies that other specific rules from the ePrivacy Directive\u2014such as the rules on cookies (Art. 5(3) ePrivacy) or the processing of traffic data (Art. 6 ePrivacy)\u2014should be considered autonomous legal bases that exclude the application of Art. 6(1) GDPR.<\/p>\n\n\n\n

      However, this does not mean that the GDPR legal grounds disappear completely. Article 6(1) GDPR will continue to apply in situations where the ePrivacy Directive itself does not provide a specific legal ground, for example when the ePrivacy Directive refers to national law (such as in Art. 15(1) ePrivacy, the basis for data retention).<\/p>\n\n\n\n

      2. The \u201csoft opt-in\u201d (Art. 13(2))<\/h3>\n\n\n\n

      The soft opt-in exception (Art. 13(2) ePrivacy Directive ) allows mailing without prior consent, provided four strict conditions are met.<\/p>\n\n\n\n

      This has been directly transposed in Belgium in Article 1, 1\u00b0 of the Royal Decree of 4 April 2003<\/a>. The RD sets identical conditions:<\/p>\n\n\n\n

        \n
      1. The contact information was obtained directly \u201cin connection with the sale of a product or service\u201d.<\/li>\n\n\n\n
      2. Marketing concerns only proprietary and similar products or services.<\/li>\n\n\n\n
      3. The customer was given a clear opt-out at the time of collection.<\/li>\n\n\n\n
      4. Each message contains an opt-out (regulated by Art. XII.13, \u00a72 CEL).<\/li>\n<\/ol>\n\n\n\n

        3. The gist of the judgment and its impact on Belgium<\/h3>\n\n\n\n

        The ruling Inteligo Media<\/em> is relevant to Belgian practice for two reasons:<\/p>\n\n\n\n