Are you allowed to send direct marketing to users with a free account?

A ruling by the European Court of Justice brings important news for any company working with ‘freemium’ models or free accounts. In the ruling Inteligo Media (C-654/23) of 13 November 2025, the Court confirmed that an e-mail address obtained through a free account may indeed be used for direct marketing.

The condition is to meet the ‘soft opt-in’ exception from the ePrivacy Directive. Important: if these conditions are met, no separate legal basis (such as consent or legitimate interest) is required under the General Data Protection Regulation (GDPR) .

The facts: a free account and an automatic newsletter

The case revolved around Inteligo Media, the publisher of the Romanian legal news website avocatnet.ro. This website used a ‘freemium’ model:

1. A visitor could read 6 articles per month for free.
2. To read more (free) articles, the user had to create a free account. This required an e-mail address.
3. When creating that account, the user also received access to 2 additional free articles as well as a daily newsletter (“Personal Update”).
4. This newsletter contained summaries of new articles, with hyperlinks leading to the website, where users were then faced with a pay wall for the full ‘premium’ content.
5. Importantly, users could unsubscribe immediately upon registration (via an opt-out box) and each newsletter contained a clear unsubscribe link.

The Romanian Data Protection Authority (ANSPDCP) fined the company approximately €9,000. The regulator's reasoning was that Inteligo Media had collected the email addresses for one purpose (executing the ‘free account’ agreement) but then unlawfully used them for another purpose (direct marketing), without having the required consent under the GDPR.

The decision of the Court of Justice

The Romanian court referred preliminary questions to the Court of Justice. The Court had to answer essentially three questions:

1. Is this newsletter “direct marketing”?
   
   Yes. The Court held that even though the newsletter is informative in nature (summaries of news), its ultimate purpose is commercial: to encourage users to reach the free article limit and take out a paid subscription.
   
   
2. Is creating a free account a “sale of a product or service”?
   
   Yes. This is the crux of the ruling. The Court states that an email address obtained when creating a free account, which provides access to free content and offers the option of paid content, was indeed obtained “in the context of the sale of a product or service.” The “payment” here is indirect: the promotion of the paid service.
   
   
3. If the ePrivacy rules are met, is a separate GDPR legal basis still needed?
   
   No. The Court confirms that the ePrivacy Directive is a lex specialis (a more specific law). If the processing meets the specific conditions of “soft opt-in” (Article 13(2) of the ePrivacy Directive), the general conditions of lawfulness from Article 6(1) of the GDPR do not apply.
   
   The Court relies on Article 95 of the GDPR, which states that the GDPR does not impose additional obligations where the ePrivacy Directive already provides specific rules. The Court finds that Article 13(2) (the soft opt-in) is such a specific rule. It is a stand-alone legal ground that replaces the application of Article 6(1) GDPR (with its list of legal grounds such as consent, agreement, legitimate interest, etc.).

Legal analysis and interpretation

This ruling has direct implications for Belgian legal practice and corrects the recent recommendation of our own Data Protection Authority (GBA).

1. ePrivacy as ‘lex specialis’

The GDPR regulates general data processing, but the ePrivacy Directive is a lex specialis (specific law) for electronic communications.

In Belgium, the view of the GBA, as recently expressed in its Recommendation 01/2025, was that the ‘soft opt-in’ (Art. 13(2) ePrivacy) found its legal basis in ‘legitimate interest’ (Art. 6.1.f GDPR). This implied that, in addition to the soft opt-in conditions, a company had to carry out an additional balancing of interests.

The ruling Inteligo Media corrects this view. The Court clearly states that when the conditions of Art. 13(2) ePrivacy are met, it is an autonomous legal ground and the legal grounds in Article 6(1) GDPR (including ‘legitimate interest’) do not apply.

Moreover, the scope of this ‘lex specialis’ reasoning is likely to be much broader than just direct marketing. As the EDPB (the European Data Protection Board) already indicated in 2019 (Opinion 5/2019), this ruling implies that other specific rules from the ePrivacy Directive—such as the rules on cookies (Art. 5(3) ePrivacy) or the processing of traffic data (Art. 6 ePrivacy)—should be considered autonomous legal bases that exclude the application of Art. 6(1) GDPR.

However, this does not mean that the GDPR legal grounds disappear completely. Article 6(1) GDPR will continue to apply in situations where the ePrivacy Directive itself does not provide a specific legal ground, for example when the ePrivacy Directive refers to national law (such as in Art. 15(1) ePrivacy, the basis for data retention).

2. The “soft opt-in” (Art. 13(2))

The soft opt-in exception (Art. 13(2) ePrivacy Directive ) allows mailing without prior consent, provided four strict conditions are met.

This has been directly transposed in Belgium in Article 1, 1° of the Royal Decree of 4 April 2003. The RD sets identical conditions:

1. The contact information was obtained directly “in connection with the sale of a product or service”.
2. Marketing concerns only proprietary and similar products or services.
3. The customer was given a clear opt-out at the time of collection.
4. Each message contains an opt-out (regulated by Art. XII.13, §2 CEL).

3. The gist of the judgment and its impact on Belgium

The ruling Inteligo Media is relevant to Belgian practice for two reasons:

• “Sale” does not require direct payment: The biggest stumbling block to freemium models was the first condition: is a free account a “sale”? The Court now says a resounding yes. The “sale” consists of providing a service (free access) in exchange for indirect remuneration, such as promoting paid content. This gives Belgian companies working with freemium models a solid basis to apply the soft opt-in (Art. 1, 1° RD), something that was previously legally uncertain.
• “Direct Marketing” is very broad: The Court ruled that the Romanian newsletter was “direct marketing,” despite its informative content. This confirms the broad interpretation adopted by the Belgian DPA. In Recommendation 01/2025, the DPA states that any message with “promotional content” or “mixed content” (informative as well as promotional) counts as direct marketing. An informative newsletter that (subtly or not) promotes the company's image or other services is and remains direct marketing.

What this specifically means

• For companies with ‘freemium’ models: This is very good news. You may use email addresses you collect through free accounts for direct marketing for your paid (‘premium’) services. You do not have to ask for a separate consent (opt-in) for this, provided your opt-out mechanism is perfect (both at registration and in each mail).
• For pure ‘free’ services: Be careful. The Court does link the “sale” to the fact that a paid service is being promoted. If your business offers only free services (e.g., funded by third-party advertising), it is unclear whether you can rely on this exception.
• For supervisors (such as the DPA): The DPA will have to update its Recommendation 01/2025. The soft opt-in (Art. 1, 1° RD) cannot be invoked on the basis of ‘legitimate interest,’ but is an autonomous legal basis that does not require further review under Art. 6(1) GDPR.

Frequently asked questions (FAQ)

What exactly is the soft opt-in?
The ‘soft opt-in’ (contained in Art. 13(2) ePrivacy Directive and Art. 1, 1° of the 2003 Belgian Royal Decree ) is an exception to mandatory consent (opt-in) for e-mail marketing. It allows companies to mail their existing customers about similar products or services, as long as those customers have had the opportunity to opt-out, both at the time of purchase and in each subsequent mail.

Does this ruling replace the GDPR?
Absolutely not. This ruling clarifies the relationship between the two laws. The GDPR remains the general law for all data processing. However, for the specific subject of e-mail marketing, the more specific rules of the ePrivacy Directive (and its Belgian transposition) apply as lex specialis.

Should I start emailing all my free users now?
Not just like that. You must verify that you have met all the soft opt-in requirements. Crucially, you must have already offered these users a clear, simple opt-out option when they registered their free account. If you did not do so at the time, you cannot apply the soft opt-in retroactively.

Conclusion

The Inteligo Media-ruling is a victory for the economic realities of the Internet. It confirms that a ‘free’ user can indeed be considered a ‘customer’ within the meaning of ePrivacy laws, opening the door for marketing via the more lenient soft opt-in.

More importantly, it corrects that the soft opt-in is not an interpretation of ‘legitimate interest’ but an autonomous legal basis and thus corrects the recent recommendation of the Belgian DPA. For Belgian companies, it finally provides the necessary legal certainty for freemium services. However, this requires a flawless implementation of your privacy processes in accordance with the strict conditions of the 2003 RD.