EU Court of Justice: even "free" services can constitute a "sale" under the ePrivacy Directive and make the subsequent soft spam mechanism lawful.

With its judgment C-654/23 of 13 November 2025, the Court of Justice of the EU established a principle intended to have a concrete impact on digital and marketing strategies: the creation of a free user account can already constitute a "sale" within the meaning of Art. 13(2) of the ePrivacy Directive, making it legitimate to send promotional newsletters through the soft spam mechanism(which is transposed into our Privacy Code in Article 130, paragraph 4).

The "sale" exists even without payment: indirect remuneration is enough. The Court clarifies that no economic consideration is needed to constitute the sale of a service. An indirect economic utility is sufficient: for example, a free account that serves as a lever to induce the user to subscribe to a paid subscription or that integrates the costs of the free offer into the price of the premium product.

In these cases , a genuine contractual relationship is established, based on the acceptance of the terms of use, which satisfies the requirement of "sale" provided for by the Directive.

On the other hand, the question remains open whether any form of free registration – even if not for commercial purposes – can fall within that concept. The Court does not rule out more restrictive or broader interpretations in the future.

The Court classifies the update newsletter as direct marketing, even though it contained informative and topical content. The real purpose, the European judge observes, was to bring the user back to the platform and encourage him to take out a full subscription after the free articles have been exhausted. The commercial purpose therefore prevails over the journalistic nature of the communication.

The judgment clarifies an essential point: when applying Art. 13(2) ePrivacy,  it is not necessary to identify an additional legal basis pursuant to Art. 6 GDPR. The ePrivacy Directive operates as  a lex specialis, and – thanks to Article 95 GDPR – prevails over the general provisions of the regulation.

Therefore, if the requirements of soft spam are complied with (pre-existing business relationship, similar services, clear information and free right to object), the sending of the newsletter is fully lawful without further obligations.

The ruling thus contradicts the practice, still widespread among some authorities, of requiring a dual legal basis (ePrivacy + GDPR). The lawsuit arose from a sanction imposed by the Romanian privacy authority for lack of GDPR consent, but the Court excluded this obligation, confirming the autonomy of art. 13(2) ePrivacy.

A significant passage concerns the potential impact also on cases in which consent is required by art. 13(1) ePrivacy: If the Court were to apply the same principle of specialty, GDPR consent – with its more stringent requirements – may not be necessary.

This is not yet a definitive landing, but the ruling opens up a possible interpretative evolution.