The National Commission on Informatics and Liberty (CNIL) has published a decision to close the injunction against SOLOCAL MARKETING SERVICES, which was initially sanctioned for breaches related to the collection of consent for commercial prospecting.

Facts and context

The National Commission on Informatics and Liberty (CNIL) has published a decision to close the injunction against SOLOCAL MARKETING SERVICES, initially sanctioned with a fine of €900,000 for breaches related to the collection of consent for commercial prospecting.

The case originates from a sanction decision in May 2025, where the CNIL found that the consent collected by the company's partners for prospecting operations was neither freely given nor unambiguous, due to the misleading appearance of the collection forms.

Reasons for the decision

The breach initially identified by the authority concerned the validity of the consent used as the legal basis for prospecting operations.

• Obligation to collect valid consent for commercial prospecting: The company acquires data from brokers and contest site publishers, who are the originators of the collection. The restricted panel judged that the misleading appearance of the collection forms implemented by these partners did not allow for freely given and unambiguous consent from individuals, in accordance with the GDPR requirements. Consequently, the prospecting operations carried out by SOLOCAL MARKETING SERVICES on behalf of its clients were not based on a valid legal basis.

Authority's decision

The initial decision in May 2025 imposed a fine of €900,000 on SOLOCAL MARKETING SERVICES.

Furthermore, the authority ordered the company to cease its prospecting operations in the absence of valid consent within nine months, under penalty of a daily fine of €10,000 for each day of delay. The company justified having implemented control measures deemed satisfactory, including an automated analysis of its partners' collection forms supplemented by human assessment. The restricted panel therefore decided to close the injunction and not to require payment of the fine.

Lessons learned

This decision reminds that:

• Implementing control mechanisms for partners does not relieve the data controller of its final responsibility regarding the validity of the consent collected on its behalf.
• A verification process of the validity of consent collected by third parties, combining automated analysis of forms and human assessment, can be considered a satisfactory compliance measure by a supervisory authority.
• Even after implementing control measures, an organization's responsibility may be engaged if non-compliances persist and escape its vigilance.