With its decision no. 17278 of July 2, 2018, the Supreme Court condemns the increasingly widespread practice of websites sending advertising communications without the specific consent of the person concerned and recalls the rules for advertising on the web.


This decision settled a dispute that started back in 2014 following an order issued by the Data Protection Supervisor, which found that the processing of personal data for promotional purposes by a company specializing in the web services sector was unlawful, without the “free and specific” consent of the parties concerned. In particular, users of the site, in order to access web services (newsletters on finance, taxation, law and labor) had to register by providing their email and give general consent to the processing of personal data. The information, however, was made accessible only through a link to a different web page which clarified that the data was used not only for the provision of the service but also for “the sending of promotional communications and commercial information by third parties. In the absence of consent the user could not use the service”.

Following the opposition of the company inhibited by the Guarantor, the Court of Arezzo acknowledged that consent had been legitimately given also for promotional purposes, not providing for the additional legal obligations inferred from the guidelines of the Guarantor.

The Supreme Court, with the recent decision mentioned above, in accepting the appeal of the Guarantor, has instead recognized illegitimate behavior by the company of web services, pointing out that, with regard to personal data, one must refer to a notion of informed consent which “does not admit compressions of any kind and does not tolerate being disturbed even if marginally, not only as a result of error, violence or fraud, but also as a result of the whole range of possible disorientation, stratagems, opacity, subterfuges, unfairness, duplicity or malice however adopted by the data controller”. The Court also reiterates that consent must be free and specific, requiring an indication of the sectors of goods or services to which the advertising messages relate.

The Court further adds that a condition may be regarded as being satisfied if the service offered by the operator of the website is impracticable and indispensable for the person concerned.

Finally, the Supreme Court has provided the following principle of law: “in terms of the processing of personal data, the provision of Article 23 of the Privacy Code, in establishing that consent is validly given only if expressed freely and specifically with reference to a clearly identified processing, allows the operator of a website, which provides a fungible service, which the user can give up without serious sacrifice (in this case newsletters on issues related to finance, taxation, law and labor) to make the provision of the service conditional upon the processing of the data for advertising purposes, provided that the consent is given individually and unequivocally to such effect, which also implies the need, at least, to indicate the sectors of goods or services to which the advertising messages will refer”.