FDPIC · decision ·
Advertising without provable consent: the FDPIC orders the data deleted
By Advisorn · guidance, not advice
In brief
The FDPIC has prohibited Add Conti GmbH from processing personal data for advertising without valid consent and ordered it to delete the data within 30 days of the decision becoming final. Anyone who uses data for marketing must be able to prove consent (Art. 6 and 31 FADP).
What happened
The company supplied addresses to advertisers and said the consents came from online prize draws. The people who had turned to the FDPIC, resident in Germany, denied having taken part.
The FDPIC did not find this account credible: the prize draws could only be reached by typing in the address, the pages consisted almost entirely of legal notices and named the same three winners for months. The company could not prove valid consent.
Nor did it answer requests for access, erasure and objection, and having entrusted them to service providers in Germany did not exempt it (Art. 25 FADP). The decision of 26 June 2026 is final.
What it means for an SME
Keep a record of when and how each person gave consent. Be wary of purchased address lists with a "consent" you cannot prove.
Answer people's requests within 30 days, even when a service provider handles them: the responsibility remains yours.
Source: FDPIC communication of 22 October 2026. General information summarised from the source, not advice on your case: for your case, the text of the decision or the law is what counts.