A company collects leads through an online contest, transfers the files to three data brokers, and then launches an email campaign to several million contacts. A few months later, the CNIL imposes a fine and a penalty of 10,000 euros per day for lack of valid consent.
This scenario is not hypothetical: it illustrates the concrete regulatory pressure on current marketing practices. The ethical stakes of marketing are no longer just a superficial discourse; they condition the operational survival of campaigns.
Consent and prospecting: the legal risk that marketing teams underestimate
It is often thought that the consent issue is limited to cookie banners. In reality, deceptive data collection forms have become a major legal risk for any prospecting campaign. When an internet user checks a pre-filled box in a contest without understanding that they are agreeing to be contacted by third parties, the consent is not valid under GDPR.
The CNIL has sanctioned this type of practice by targeting not only the final advertiser but also the intermediaries in the chain: data brokers, contest publishers, collection sites. This approach changes the game for marketing teams that purchase prospect databases. Publicly accessible data remains personal data, and its transmission for prospecting purposes must comply with the same rules.
In practice, one must verify the quality of consent upstream, with the provider of the database. A simple transfer contract is no longer sufficient: it is necessary to document the consent chain, form by form. This is a task that most marketing departments have not integrated into their media buying processes, and it directly concerns marketing on Business Ethique in its responsible dimension.
Generative AI and responsible marketing: traceability of training data
Generative artificial intelligence poses a problem that few operational teams have anticipated. When using a model to generate marketing content (headlines, visuals, email personalization), the question is not just about the quality of the result. An AI model may fall under GDPR if it retains personal data and allows for its extraction.
The CNIL specifies that model providers must be able to document the analysis of the model’s status under GDPR, and in many cases, conduct re-identification tests. For a marketing department that outsources content generation to a provider using an LLM, this means a new obligation of vigilance.
In practice, one finds themselves needing to ask questions that our providers do not always know how to answer: what data was used to train the model, is there a risk of re-identification, has the provider conducted the required tests. Responses vary on this point depending on the maturity of the providers. But ignoring the question exposes the advertiser to direct liability.
Environmental claims: proving what you assert in your campaigns
Greenwashing has long been treated as an image problem. European regulatory pressure is transforming it into a proof problem. Any environmental claim in a campaign must now be supported by verifiable evidence, under penalty of sanctions.
The European framework being deployed specifically targets vague claims (“eco-friendly,” “natural,” “planet-friendly”) when they are not based on documented methodology. For field teams, this implies a workflow change:
- Each environmental mention in a creative brief must be associated with a verifiable source (certification, life cycle analysis, recognized label like the EU Ecolabel)
- Legal teams must validate claims before dissemination, not after a complaint
- Subcontractors (agencies, freelancers, media companies) must be contractually held to the same proof requirements
This is no longer a stance of an engaged brand. It is a regulatory constraint that applies to the very mechanics of campaign production.
The trap of self-proclaimed labels
We are seeing labels created by sectors or brands themselves, without external audit. A label without an independent certifying body has no probative value within the European regulatory framework. Displaying a green pictogram invented internally on packaging can now be classified as a misleading commercial practice.
Extended ethical responsibility to intermediaries in the advertising chain
The most structuring underlying trend for marketing departments is the extension of responsibility to the entire chain. One can no longer be satisfied with verifying their own practices: it is necessary to audit those of their partners.
The recent sanctions from the CNIL explicitly target data brokers and collection sites, not just the advertiser. But in the case of a non-compliant campaign, it is the brand that suffers reputational damage. Responsible marketing thus requires mapping its intermediaries and documenting their practices.
- Identify each actor in the data chain (collector, enhancer, distributor)
- Verify the proof of consent provided by each link
- Integrate GDPR compliance clauses into media and data purchasing contracts
- Provide for an audit or periodic control mechanism
This approach requires time and resources. But it protects against financial sanctions and, above all, against the loss of consumer trust when they discover that a brand is exploiting their data without real consent.
The ethical marketing strategy now plays out in contracts and internal processes, long before the design of the advertising message. Companies that treat ethics as a communication topic without embedding it in their operations expose themselves to increasing sanctions and a visible gap between discourse and practices. The regulatory framework no longer allows for approximation.
