On November 26, 2021, the Court of Justice of the European Union (CJEU) held[1] that the display of advertising messages in an email inbox, in a form similar to an email, constitutes direct marketing and requires users’ consent under the ePrivacy Directive.[2]
The CJEU also held that this practice constitutes ‘persistent and unwanted solicitations’ under the Unfair Commercial Practices Directive[3] when those advertising messages are displayed to users without prior consent, on a frequent and regular basis.
Background
At an advertiser’s request, an advertising agency displayed advertisements, in the form of banners directly visible in email inboxes, to users of a free email service (a practice called ‘inbox advertising’). Those banners appeared as soon as users of the email service opened their inbox, and they were not clearly distinguishable from other emails in the user’s inbox, except that the date of the message was replaced by ‘advertisement.’ A competitor of the advertiser brought suit, claiming that the practice was unlawful under unfair competition law. The case was heard on appeal by the German Federal Court of Justice, which referred the case to the CJEU, asking whether this practice of inbox advertising is compliant with EU Law.
CJEU Holding
The CJEU held that inbox advertising is a use of electronic mail for direct marketing purposes. According to the CJEU, such practices are likely to breach the objective of protecting users from any intrusion into their private life by unsolicited communications.[4] The CJEU found that the banner advertisement would, in practice, have similar effects to unsolicited email and could lead a user who clicks on the link contained in the banner advertisement to be redirected, against their will, to the advertiser’s website.
Impact of the CJEU Ruling
Several aspects of the CJEU ruling, described below, are of interest for companies in the ad tech industry or using inbox advertising.
1. Communications Provided Through Email Inboxes Are “Electronic Mail”
The rules on direct marketing apply to marketing operated via ‘automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail.’[5] The CJEU considers that inbox advertising constitutes a use of ‘electronic mail’ because the communications have been provided to the users through their email inbox. It is worth noting that the CJEU does not analyze in detail the definition given in the ePrivacy Directive to assess whether the communications themselves are ‘electronic mail,’[6] but states only that they are received using an email service[7] and highlights that the advertising communications are displayed in the user’s inbox (i.e., in a space generally reserved for private emails, unlike traditional advertising banners or pop-up windows appearing at the outer edge of private messages, or separately from them). The CJEU also observed that the user can only get an overview of his private emails after checking the content of the advertising communication and actively deleting it. Because the users are required to perform such actions to avoid the nuisance of the advertisement, the CJEU considered the advertisements to be similar to spam.[8]
2. Inbox Advertising, Even Random, Requires Consent
The CJEU requires three conditions for a communication to qualify as direct marketing: 1) a communication for a commercial purpose that reaches, 2) directly, and 3) individually, one or more users of the email service. The CJEU found that the very nature of inbox advertising, which is to promote services, and the fact that they are distributed in the form of an email directly available in the inbox, qualifies those advertisements as ‘communications for the purposes of direct marketing.’[9] The fact that the user must use their credentials to log in to their inbox and see the communication makes the communication individualized, regardless of the fact that the recipient of those advertising messages is chosen at random.[10]
The CJEU noted that communications for direct marketing purposes require prior consent.[11] Inbox advertising, therefore, requires a freely given, specific, and informed consent of the person concerned. In this case, the users had the option to benefit from free email service funded by advertising, or to use a paid-for email service without advertising. The CJEU did not clarify whether the fact that users chose the free option could be considered valid consent, but it noted the high threshold for consent under the GDPR. The referring court will have to determine whether the user concerned was duly informed of the precise means of distribution of such advertising and, in fact, consented to receiving advertising messages.[12]
3. Inbox Advertising Is a Form of ‘Persistent and Unwanted Solicitations’
Conducting ‘persistent and unwanted solicitations’ is a prohibited practice, considered unfair under EU law.[13] In its determination that inbox advertising constitutes a ‘solicitation,’ the CJEU considered that inbox advertising is addressed directly and individually to the user. To establish that the solicitation is ‘persistent and unwanted,’ the CJEU stated that the communications were displayed on three occasions, despite obtaining no prior consent. Accordingly, the communications fall within the concept of ‘repeated and unwanted solicitations,’ prohibited under EU law.[14] To the contrary, if prior consent is obtained, these communications would no longer be ‘unwanted.’
Conclusion
Companies operating in the ad tech space should consider reviewing their practices in light of this recent CJEU decision, and in particular analyze whether these communications 1) could be ‘electronic mail’; 2) constitute direct marketing, and thus 3) require obtaining opt-in user consent.
[1] CJEU judgment in case C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz GmbH v. eprimo GmbH, November 25, 2021 <https://curia.europa.eu/juris/document/document.jsf?text=&docid=250043&pageIndex=0&doclang=FR&mode=req&dir=&occ=first&part=1&cid=2840651> (in French).
[2] See the corresponding press release at https://curia.europa.eu/jcms/upload/docs/application/pdf/2021-11/cp210210en.pdf.
[3] With the meaning of Annex I, point 26 of the Directive 2005/29/EC of the European Parliament and of the Council of May 11, 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council (Unfair Commercial Practices Directive).
[4] With the meaning of recital and article 13 of the ePrivacy directive, i.e., directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).
[5] Article 13(1) ePrivacy Directive.
[6] As per article 2(h) ePrivacy Directive, electronic mail means “any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient.”
[7] Recital 45 in C-102/20.
[8] Recital 40-46 in C-102/20.
[9] Recital 47-50 in C-102/20.
[10] Recital 51 in C-102/20.
[11] Article 13(1) ePrivacy Directive.
[12] Recital 59 in C-102/20.
[13] Article 5 and Annex I, point 26 of the Unfair Commercial Practices Directive.
[14] Recital 64-75 in C-102/20.