In a legal case involving Groupe Canal+ and France's data protection authority, the CNIL, Advocate General Dean Spielmann of the Court of Justice of the European Union (CJEU) has argued that agreeing to be contacted by an enterprise's "partners" does not amount to sufficiently informed consent if the identity of those partners is not known. This issue arises in the context of commercial activities such as newsletters, contests, and outreach in the book industry. The case, labeled C-317/25, involves 3.9 million individuals contacted in 2021 by Groupe Canal+, which had obtained their contact details from two internet service providers. The CNIL fined Groupe Canal+ 600,000 euros in 2023 for violations of the General Data Protection Regulation (GDPR) and the Code of Posts and Telecommunications, citing insufficient consent for commercial outreach. Groupe Canal+ challenged this decision before the Council of State, which referred the case to the CJEU for clarification. Spielmann emphasized that if the identity of the data controller was not known at the time of initial consent, that does not justify later commercial outreach. He stated that companies must obtain fresh consent before proceeding with any such communications. Even the presence of an unsubscribe option in the initial message does not resolve the issue, as it appears after the outreach has already started. Spielmann explained that for a single category of recipients to be considered valid, it must be specific enough to allow individuals to reasonably understand which company might contact them. The term "partners" is too vague to meet this standard. The implications of this case extend beyond Groupe Canal+ and could affect any organization that collects or receives contact details for commercial use, including those in the book industry. The CNIL has stated that when an organization collects consent on behalf of its partners, individuals must be clearly informed of the partners' identities and the purposes of the outreach. A complete and current list of these partners must be available when the initial agreement is made. If the first organization only collects permission to share contact details, the partner companies must then obtain their own consent before initiating any commercial communication with individuals. The CNIL acknowledges that under certain conditions, an organization may request consent through a solicitation, but this should not be used to promote its brand, products, or services. For individuals, commercial outreach via email, SMS, or automated calls still requires prior consent, with limited exceptions for existing customers. The rules for outreach to professionals differ. Spielmann's conclusions do not introduce a new rule in France, as the CNIL already mandates transparency about data-sharing partners. However, the case now raises the question at the European level, before the court responsible for interpreting the GDPR and the "privacy and electronic communications" directive. The final ruling will be made by the CJEU, though the exact timing of the decision remains unknown.