Marketing

Legal Framework

Marketing under the GDPR is governed primarily by Article 6(1) (lawfulness of processing), Article 13 and Article 14 (transparency obligations), and Article 21 (right to object). The definitional scope of marketing-related processing — particularly profiling — is set out in Article 4:

Controllers relying on legitimate interests under Article 6(1)(f) must disclose those interests to data subjects under Article 13(1)(d) (data collected from the subject) or Article 14(2)(b) (data obtained indirectly). Where personal data are not collected from the data subject, Article 14 imposes additional information duties, including the source of the data. The right of access under Article 15(1)(h) requires controllers to inform data subjects about automated decision-making, including profiling, and to provide meaningful information about the logic involved.

Key Developments

The CJEU's January 2025 judgment in Mousse (C-394/23) confirms that direct marketing can rest on legitimate interests under Article 6(1)(f), but sets a contextual boundary grounded in data minimisation and reasonable expectations:

"the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. In particular, personalised advertising may be equated with direct commercial marketing in such a context"
— CJEU, Mousse, ¶54

The Court further narrowed the scope by holding that collecting data fields unnecessary for the transaction — such as title or gender identity when purchasing a travel document — falls outside what a consumer reasonably expects, particularly where the data serve only marketing goals. The right to object under Article 21(1) provides a backstop: once invoked, the controller must cease processing unless it demonstrates compelling legitimate grounds.

On the consent side, the EDPB's Guidelines 05/2020 establish that bundling marketing consent with service delivery is impermissible:

"If the customer's refusal to consent to this processing purpose would lead to the denial of banking services, closure of the bank account, or, depending on the case, an increase of the fee, consent cannot be freely given."
— EDPB Guidelines 05/2020, §33

Status of the Debate

This topic is actively contested in court. The boundaries of legitimate interests for marketing are not fully settled: Mousse clarifies that reasonable expectation and data minimisation constrain Article 6(1)(f), but national courts continue to grapple with where personalised advertising crosses into profiling requiring consent under Article 22, and how Article 21 objections interact with lookalike-audience and inferred-interest models. No definitive court split is on record yet regarding the threshold at which behavioural advertising becomes profiling with legal or similarly significant effects. A future CJEU reference on that specific question would resolve the open issue.

Practical Guidance

• Conduct a legitimate-interest assessment for each marketing purpose. Document the interest pursued, the necessity test, and the balance against data subject rights — Mousse confirms this is not optional for Article 6(1)(f) marketing.
• Collect only data fields necessary for the transaction. Gathering supplementary personal data (e.g., gender, title) solely for marketing at the point of sale violates the data minimisation principle and exceeds reasonable consumer expectations.
• Do not bundle consent with service delivery. If refusing marketing consent results in denial of service or price penalties, the consent is invalidly obtained.
• Provide layered transparency. When data are collected directly, disclose the marketing purpose, the legitimate interest relied upon, and the right to object under Article 21 — all at the point of collection per Article 13.
• Honour Article 21 objections promptly. Establish an automated opt-out mechanism that ceases processing without requiring the data subject to justify the objection; the burden of demonstrating compelling grounds shifts to the controller.