CALOGA: buying leads did not remove the duty to verify consent and honour withdrawal

CNIL found that collection forms used by data suppliers did not support valid consent. It also found that unsubscribe controls did not withdraw people from all four CALOGA databases with the same ease as giving consent. CNIL announcement.

CNIL rejected reliance on legitimate interests for the onward transmission it examined. It also challenged a retention practice that could keep restarting the clock when a recipient merely opened an email. Authority notice on EDPB.

CNIL imposed EUR 80,000. Its announcement says the company ceased activity in 2024 and that this was considered when setting the fine. This record does not establish payment or a later appeal result. CNIL announcement.

These are implementation checks suggested by Inth, not additional findings about the company.

• Require evidence of the collection form, notice, purposes, recipients and the person’s choice for each acquired lead.
• Test withdrawal across brands, databases and onward recipients, rather than one campaign list.
• Give retention jobs explicit end dates; check which events can restart the clock.

Code audit can trace reviewed collection and sharing routes. Consent records can preserve choices made through Inth with their country and policy.

Inth cannot reconstruct a broker’s missing consent evidence or prove that an external email platform honoured an unsubscribe request.

• CNIL announcement
• Authority notice on EDPB

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.