CJEU ruling extends existing customer privilege and facilitates newsletter distribution without consent

Sending newsletters by email is one of the most frequently used marketing tools for companies. At the same time, it is subject to strict legal requirements designed to protect against unwanted advertising. Under German law, electronic advertising without the prior express consent of the recipient is generally prohibited. The only exception is advertising to existing customers, provided certain conditions are met. In its ruling of November 13, 2025 (Case C-654/23), the Court of Justice of the European Union has now clarified how these requirements are to be interpreted – thereby significantly expanding the scope of consent-free electronic direct advertising in favor of advertisers.

Legal situation in Germany

Requirement for consent for email advertising with the exception of advertising to existing customers

Sending advertising by electronic mail (e-mail) without the prior express consent of the recipient is considered unacceptable nuisance and is therefore generally prohibited. This may, in particular, be prosecuted as an unfair commercial practice (cf. Section 7(2) no. 2 of the Act against Unfair Competition (UWG)) or as an infringement of the recipient's general personality rights. This provision aims to prevent advertising from being imposed on recipients without their consent.

However, this prohibition is not absolute. Direct advertising within existing customer relationships may be permitted without prior consent in exceptional cases. This exception arises in particular from Section 7(3) UWG, which implements Article 13(2) of the ePrivacy Directive (Directive 2002/58/EC).

An entrepreneur may, by way of exception, send advertising e-mails without prior consent if
- the e-mail address was obtained in connection with the sale of a product or service,
- the advertising relates to similar goods or services,
- the customer has not objected to the use of their e-mail address, and
- each advertising message clearly and unambiguously informs the recipient of the possibility to object.

The central prerequisite for the application of the exemption is a prior “sale” of a good or service to the recipient, who is thereby considered an “existing customer”. Until now, it has generally been assumed that such a “sale” only exists where a specific transaction for consideration has been completed with the customer. In particular, the mere initiation of sales transactions is not sufficient.

Parallel application of the GDPR

In addition to the provisions of Section 7(3) UWG, the provisions of data protection law, in particular the General Data Protection Regulation (GDPR), must be observed. This is because sending advertising e-mails generally involves the processing of personal data (e.g., an e-mail address that identifies an individual).

A valid legal basis is required for this data processing. So far, the German data protection authorities have applied Section 7 UWG and Article 6 GDPR in parallel, with the principles of Section 7 UWG being taken into account in the balancing of interests under Article 6(1)(f) GDPR. Specifically, this means: if e-mail addresses are collected directly from the data subject in the context of an existing contractual relationship, the data subject’s legitimate interests will generally not prevail, provided that the above-mentioned requirements of Section 7(3) UWG for electronic advertising are met. In that case, no consent is required for sending the advertising e-mail from a data protection perspective either.

CJEU clarifies requirements for email advertising without consent

In its judgment of 13 November 2025 (Case C‑654/23), the Court of Justice of the European Union (CJEU) fundamentally clarified and expanded the interpretation of the conditions for the admissibility of e‑mail advertising without prior consent, in particular by further defining the concept of “sale” within the meaning of Article 13(2) of the ePrivacy Directive. The decision was issued in connection with a legal dispute in Romania but is binding throughout the European Union.

Facts

The Romanian operator of the online portal avocatnet.ro was sanctioned by the national data protection authority for sending newsletters by e‑mail to users after they registered a free user account, without having obtained their explicit consent to receive such newsletters. The account provided limited access to additional free content and included a daily newsletter summarizing recent legislative changes, along with links to relevant articles that were available for purchase if necessary. The data protection authority considered this an unlawful processing of personal data and imposed a fine, arguing that the use of the e‑mail address for the newsletter was not compatible with the original purpose of data collection.

Newsletters for direct marketing purposes

The CJEU clarified that newsletters are considered “advertising” for the purposes of direct marketing if they serve a commercial purpose. This is particularly the case where recipients are intended to be encouraged to purchase paid offers—regardless of whether this purpose arises solely from the content of the newsletter itself or from the way the offer is presented. The fact that a newsletter also contains informational content does not alter this objective.

“Sale of goods or services” – indirect remuneration sufficient

With regard to the requirement that the customer’s e‑mail address must have been obtained in connection with the sale of a product or service, the CJEU initially confirmed that the term “sale” is necessarily linked to the payment of consideration for a good or service.

However, it is not necessary for the remuneration to be paid directly by the recipient of the service; indirect remuneration of the advertiser is sufficient. This includes situations where the free service – such as the creation of a user account – serves to promote the company’s paid offers. In such cases, the costs of the free service are economically factored into the price of the paid offers.

The CJEU justified this on the grounds that, according to the wording of the provision, the electronic contact details must only be obtained “in the context of the sale”. Even under a generally strict interpretation, the exception must be understood in a way that preserves its practical effectiveness. Limiting it to direct payments would run counter to the purpose of the provision and would effectively undermine the existing customer privilege.

No additional legal basis required under the GDPR

At the same time, the CJEU addressed the question of whether companies relying on the existing‑customer privilege also need an additional legal basis under Article 6 GDPR.

The Court expressly denied this and clarified that Article 13(2) of the ePrivacy Directive contains specific and exhaustive rules for the processing of personal data in connection with electronic communications. Under Article 95 GDPR, no additional requirements may be imposed when assessing the lawfulness of such data processing.

In practice, however, this changes little, as data processing within the scope of the existing‑customer privilege has in any case been justified on the basis of legitimate interests (see above under I.2.).

Conclusion and recommendations for action

The CJEU’s judgment is a landmark decision for the previously strict requirements on existing‑customer advertising and opens up new opportunities for e‑mail marketing: where the free creation of a user account is aimed at promoting a paid offer, companies may in future send newsletters to the respective users without having to rely on explicit consent (including the double opt‑in procedure).

Nevertheless, strict compliance with the requirements of Section 7(3) UWG, Article 13(2) of the ePrivacy Directive, and other data protection obligations remains essential. It must therefore be ensured that information duties and rights to object are implemented transparently and consistently.

This client information only contains a non-binding overview of the subject area addressed in it. It does not replace legal advice. The following are available as contact persons for this client information and for your advice: