I. Introduction
The first Court of Justice of the European Union (CJEU) case to address platform obligations from a data protection perspective was Google Spain.Footnote 1 In that case, the CJEU struck a much-debated balance in favour of reactive obligations, even if it characterised the search engine as a data controller. This led commentators to suggest that notice-and-takedown practices informed the newly introduced notice-and-delist obligation imposed on search engines.Footnote 2
Such a framing was confirmed a couple of years later in GC et al v CNIL, in which the CJEU held that search engines are subject to the prohibition to process special categories of personal data under Article 9 of the General Data Protection Regulation (GDPR)Footnote 3 following a data subject’s request.Footnote 4
The CJEU’s position in Google Spain was notable because data controllers are generally subject to proactive obligations, which under the GDPR comprise the requirement of data protection by design and by default.Footnote 5 Moreover, under EU data protection law, a controller is typically understood to play an active role in the processing of personal data, as the concept presupposes influence over both the purposes and the means of processing. This is true even if there exists in reality a spectrum of such active roles, as demonstrated by case law in which platform users have been regarded as joint controllers together with a platform.Footnote 6 By contrast, under a different body of EU law, initially set forth under the E-Commerce Directive (ECD),Footnote 7 platforms and search engines had, until Google Spain, been treated as candidates for intermediary liability exemptions, when deemed neutral actors.Footnote 8
More than a decade after Google Spain, the CJEU appears to be recalibrating its approach. In its Russmedia judgment delivered on 2 December 2025,Footnote 9 the Court holds that an online marketplace operator may be subject to a set of due diligence obligations. These obligations are triggered not by a notification targeting a particular item of content, in this case an advertisement uploaded by a user advertiser, but by the attempted upload of the item of content itself.
Notably, the CJEU does not ground these due diligence obligations in a duty of care triggered by the characterisation of “manifestly unlawful” content, as might have been expected had inspiration been drawn from earlier case law such as L’Oréal v eBay.Footnote 10 Instead, the CJEU grounds them in the processing of special categories of personal data within the meaning of Article 9 GDPR, thereby suggesting a significantly broader scope for such obligations. At the same time, the CJEU expressly holds that these due diligence obligations are not tantamount to general monitoring obligations prohibited under Article 15 ECD, now also under Article 8 of the Digital Services Act (DSA).Footnote 11 It thus confirms a progressive narrowing of the concept of general monitoring.Footnote 12
Over two decades after its adoption, the ECD section on intermediary liability was finally repealed and subsumed in the DSA, which is applicable for the most part since 17 February 2024.Footnote 13 There are subtle differences between the framing of the ECD and the DSA, particularly as regards the delineation of their respective scopes and the range of obligations imposed on intermediary service providers. The DSA is presented as a response to an ongoing call from Member States to introduce new diligence requirements for providers of intermediary services.Footnote 14 At the same time, it clearly stigmatises a series of personal data processing activities through the introduction of a set of prohibitions.Footnote 15 Could it be that the CJEU in Russmedia was attempting to anticipate the DSA through an expansive interpretation of the GDPR?
The purpose of this paper is to assess whether the CJEU in Russmedia is inflecting its prior case law and thereby shifting its approach to adapt to an era in which platforms are viewed far more critically than in previous decades. It also considers whether such an approach is compatible with the DSA.
The paper proceeds in three stages. First, it dives into Russmedia, unpacking the line of reasoning adopted by the CJEU. Second, it introduces a distinction between notice-level and upload-level due diligence and explores the shift of regulatory paradigm from notice to upload-level due diligence that seems to emerge from Russmedia. Third, it evaluates whether the ruling aligns with the core principles of both the DSA and the GDPR, or whether its scope should be confined to the ECD era.
Through its analysis, the paper shows that Russmedia is significant in that it engages with core concepts of both EU platform law and data protection law, while exposing the fragile foundations of platform law built on the early assumption that in-scope services are neutral because they involve “merely technical and automatic processing.”Footnote 16 That assumption appears increasingly untenable in light of contemporary algorithmic practices and the central role of service design. Against this backdrop, the paper acknowledges that there is clear value in characterising the forms of controllership exercised by intermediary service providers. At the same time, the paper cautions against recasting data protection law as a form of online safety law, a shift that would undermine the GDPR’s carefully calibrated balance between fundamental rights and, paradoxically, risk privileging preventive content control over a design-based approach.
II. The CJEU holding in Russmedia
The facts in Russmedia are relatively straightforward. From the applicant’s perspective, they appear particularly egregious, presenting a scenario in which the alleged harm is readily understood and its impact immediately apparent. Despite this shared understanding of the facts, the Advocate General (AG) and the CJEU diverge in how they characterise the role of the intermediary service provider. By departing from its AG, the CJEU paves the way for a finding of liability and the potential imposition of monetary compensation on the defendant, the operator of an online marketplace.
1. Facts & proceedingsFootnote 17
In a nutshell, the case at hand concerns Russmedia Digital (hereafter Russmedia), the operator of an online marketplaceFootnote 18 where advertisements for, inter alia, the sale of goods or the provision of services in Romania can be published either free of charge or for a fee. Notably, the platform includes a section dedicated to escort and matrimonial services.
An unidentified third party had posted an ad on that website falsely presenting the applicant as offering sexual services. The advert included photographs of the applicant, used without her consent, as well as her telephone number. Copies of the advert were subsequently reposted on other advertising websites, each referencing the original source. When the applicant contacted Russmedia, the company removed the advert from its site within an hour. However, the advert continued to appear on other websites that had reposted it.
The applicant filed a lawsuit against Russmedia on multiple grounds, including violation of image rights, honour, reputation, privacy, and data protection. The Court of First Instance of Cluj-Napoca (Romania) ordered Russmedia to pay damages for the non-material harm caused. Russmedia appealed, and the Specialised Court of Cluj upheld the appeal. It reasoned that Russmedia merely provided a hosting service for the advertisement and therefore could benefit from the liability exemption under Article 14(1)(b) of Law No. 365/2002, which transposes the ECD.
The applicant then appealed, arguing that Russmedia did not qualify as a hosting provider under Law No. 365/2002, since it exercised “a management role, intervening in terms of content to ensure proper information management.”Footnote 19 The applicant also contended that Law No. 365/2002 did not preclude the application of the GDPR to Russmedia.
The Court of Appeal of Cluj, whose decision is final, decided to refer a set of four questions to the CJEU. This referral was prompted by the nature of the content, which the court considered “manifestly unlawful and deeply harmful to the data subject,”Footnote 20 and the fact that the CJEU had not yet addressed a situation of this kind.
The four questions referred to the CJEU by the CLUJ Court of Appeal touch on several important EU law concepts, including the definitions of hosting provider, controller and joint controller, as well as the scope and effects of obligations of controllers under various GDPR provisions, including Articles 5, 6, 7, 24 and 25 GDPR, and the impact of Articles 12–15 ECD.
The CJEU states that answering the four questions essentially requires tackling two questions: first, whether “the operator of an online marketplace, (…) which allows its users to place advertisements anonymously on its online marketplace free of charge or for a fee, has failed to fulfil its obligations under the GDPR” considering that the advertisement placed contained special categories of personal data;Footnote 21 and second whether Articles 12 to 15 ECD are applicable to such an operator.Footnote 22
2. The CJEU’s line of reasoning
Departing from its AG’s opinion on several key points, the CJEU holds that:
-
1. The operator of an online marketplace is a controller of the personal data contained in an ad published on that online marketplace.Footnote 23
-
2. The operator of an online marketplace is required, before publishing ads, to identify the ads that contain special categories of personal data, and verify whether the user advertiser is either the subject of the data or the user advertiser can demonstrate that he/she has an appropriate legal basis to publish such data under Article 9 GDPR.Footnote 24
-
3. The operator of an online marketplace is required to implement measures to prevent ads containing sensitive data from being copied and unlawfully published on other websites.Footnote 25
-
4. The operator of an online marketplace, as controller of the personal data contained in ads published on its platform, cannot avail itself of Articles 12–15 ECD, with respect to infringements of Article 5(2), Articles 24 to 26 and 32 GDPR.Footnote 26
The CJEU’s reasoning can thus be broken down into three steps. First, it deems Russmedia a controller under the GDPR. Second, it imposes a series of proactive obligations upon Russmedia, which it grounds in a variety of GDPR provisions, including Article 25 GDPR and the requirements of data protection by design and by default. Third, the CJEU adopts a seemingly literal interpretation of Articles 1(5)(b) ECD and 2(4) GDPR, which addresses the relationship between these two instruments.
a. Step one: characterising controllership
Step one involves considering that the operator of an online marketplace acts as the data controller for processing operations consisting in making ads containing personal data publicly available through the online marketplace.
The CJEU’s approach diverges from the AG’s position that an online marketplace operator qualifies as a processor. In his opinion, AG Szpunar draws a distinction between two types of personal data and thereby two different chains of processing operations: “personal data contained in advertisements posted on that online marketplace,”Footnote 27 and personal data required to register an account.Footnote 28 As regards personal data contained in ads, the AG then distinguishes between the initial processing and subsequent processing and states that because the making available of an advert on an online marketplace is “generally intended to promote the product or service offered by a user advertiser to the public,” in data protection parlance, the processing purpose is therefore determined by the user advertiser concerned.Footnote 29 As regards influence over processing means, at most the operator of the online marketplace is considered to exert an influence over non-essential means of processing, which for the AG is not enough to make it a controller even if “the operator determines the layout of the advertisements and other technical and organisational aspects of how the online marketplace operates.”Footnote 30 The AG acknowledges, however, that the subsequent processing of personal data contained in ads by the operator of the online marketplace is under the determining influence of the operator of the online marketplace, who therefore acts as a data controller at a later time.Footnote 31
The AG views his position as being consistent with both Article 29 Working Group Opinion 1/2010 of 16 February 2010 on the concepts of “controller” and “processor” and the European Data Protection Board (EDPB) Guidelines 07/2020 on the concepts of controller and processor in the GDPR, adopted on 7 July 2021.Footnote 32
The CJEU declines to follow its AG on this crucial point of qualification and opts to pursue a line of reasoning it seems to have started in a judgment about a Facebook fan page.Footnote 33 For the CJEU the operator of an online marketplace exercises determining influence over the personal data contained in adverts, as “the general terms and conditions of use of that marketplace give Russmedia considerable freedom to exploit the information published on that marketplace.”Footnote 34 To be more precise, the CJEU holds that “the content of the general terms and conditions of use of the online marketplace concerned may provide evidence demonstrating that the operator of that marketplace exerts a decisive influence over the processing of personal data concerned.”Footnote 35 Although the CJEU admits that the operator does not have “actual influence” over the content of adverts, this consideration is not sufficient to exclude the characterisation of controller. The CJEU suggests that there are two types of data controllers: principal data controllers and other, or perhaps, secondary data controllers. Despite playing a less significant role than principal data controllers, secondary data controllers can still be considered joint controllers. This is because it is not necessary to establish common decisions or equal responsibility to find joint controllership: converging decisions are sufficient.Footnote 36
There is a notable difference between Russmedia and the earlier line of CJEU judgments on data controllership, suggesting that the Court is in fact further expanding the concept of joint controllership. In the Facebook fan page case, the data at issue consists of cookie-related information, which clearly results from processing decisions made by the platform operator.Footnote 37 In that scenario, the operator contributes to decision-making about the processing by deciding which types of data are collected when a visitor accesses a fan page, while the fan page administrator assumes a higher-level role by choosing to create a page that triggers the placement of cookies upon access and is therefore regarded as a joint controller.Footnote 38
A similar situation arises in Fashion ID, where browsing-related information is at stake.Footnote 39 In this scenario, the platform operator contributes to the decision-making by determining which categories of data are transmitted to its domain, whereas the website administrator assumes a higher-level role. The website administrator chooses to embed a Facebook plug-in that causes personal data to be transmitted to the platform operator’s main domain,Footnote 40 and is thus likewise considered a joint controller.Footnote 41
By contrast, in Russmedia the platform operator does not determine (in the sense of influencing) the selection and inclusion of the categories of personal data to be processed in adverts uploaded by a service recipient. One way of reading Russmedia with a view to limit the expansion of the concept of joint controllership would be to argue that Russmedia is deemed a data controller precisely because of the contractual prerogatives it holds over the adverts. Yet, these prerogatives are difficult to reconcile with the role of a processor. In other words, this reading would treat the marketplace’s general terms and conditions, which confer on Russmedia broad freedom to exploit published information, as one important factor supporting the CJEU’s conclusion.Footnote 42
b. Step two: characterising due diligence
Step two consists in imposing upon the operator of the online marketplace two categories of due diligence obligations: pre-publication obligations, and post-publication obligations.
First, at the pre-publication stage, the operator of an online marketplace is required to screen ads in advance, identify those containing special categories of personal data, and verify that the advertiser is either the data subject or can demonstrate a valid legal basis for publication under Article 9 GDPR. Second, at the post-publication stage, the operator appears to be subject to an ongoing duty to implement measures aimed at preventing adverts containing sensitive data from being copied and unlawfully republished on third-party websites. Framed in this way, the obligations appear to reflect a dual structure of ex ante verification and ex post preventive measures. Both obligations, however, raise concerns, albeit for different reasons.
i. Pre-publication obligations
As regards the first type of obligation mainly grounded upon Articles 5(2) and 24 to 26 GDPR, the CJEU seems at first glance to be aligned with its AG. In its opinion, AG Szpunar had suggested that the operator of an online marketplace, be it a processor or a controller, should place itself in a position to be able to verify the identity of user advertisers.Footnote 43
The AG’s opinion is however hard to decipher. He does not say clearly if a controller’s obligation to “check whether the processing of personal data is based on the consent of the data subject concerned or some other legitimate basis” always implies verifying the identity of the user advertiser.Footnote 44 When speaking about processors he nonetheless states that “[identity] verification would, first, limit the risk of illegal or unfair processing of personal data relating to data subjects and, second, make it possible to combat irresponsible use of that online marketplace, as it would challenge the sense of impunity of anonymous users.”Footnote 45 One way to make sense of the AG’s opinion would be to say that according to the AG, processors and controllers should both be under an obligation to make identity verification possible. Yet, in the light of the state of the art, this seems to imply collecting identifying data in the first place.Footnote 46
The CJEU is more explicit than its AG. The Court imposes upon the operator an obligation “to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement.”Footnote 47 It also adds that “in order to be able to ensure, and to be able to demonstrate, that the requirements laid down in Article 9(2)(a) of the GDPR are complied with, the operator of the marketplace is required to verify, prior to the publication of such an advertisement, whether the user advertiser preparing to place the advertisement is the person whose sensitive data appear in that advertisement.”Footnote 48 This “presupposes that the identity of that user advertiser is collected.”Footnote 49 The CJEU thus appears to require online marketplace operators to collect identifying information, specifically that of natural persons rather than legal entities, since this data is intended to be used to determine who the data subject is. Moreover, the identifying information must be such as to enable the marketplace operator to assess whether the person depicted in the advert is the service recipient.
Grounding an identification obligation of this type, rather than a transparency, design-based obligation, in data protection law is not straightforward. It is true that, as the CJEU recalls it, under Article 13 GDPR data controllers must provide data subjects their identities and contact details.Footnote 50 However, the category of data controller comprises both legal entities and natural persons.
In addition, from a fundamental rights perspective, the challenge of identification obligations lies in the details. Requiring assurance of natural persons’ identities raises complex implementation issues, as recent developments in age assurance illustrate, creating tensions with data minimisation, the confidentiality of sensitive personal attributes, and likely further entrenching platform power.Footnote 51
One way to narrow down the CJEU holding would be to state that the obligations imposed upon platform operators are limited in scope in two ways. Although there is no clear explanation for such limitations in the CJEU judgment, they would apply only to operators of online marketplaces and to detect particularly serious interference with fundamental rights.Footnote 52 While the CJEU assumes that any publication of personal data on an online marketplace entail “significant risks to the rights and freedoms” of data subjects,Footnote 53 the unlawful publication of special categories of personal data may constitute a particularly serious interference with fundamental rights.Footnote 54 This would suggest that only special categories of personal data are in scope for proactive obligations. Still, as explained in Section III.2 and in the light of the broad definition of special categories of personal data, it is unclear how the CJEU avoids effectively requiring operators to monitor their entire user base to detect a wide range of data. What is more, the CJEU imposes upon marketplace operator an obligation to legally assess the behaviour of its users, when it writes that platform operators “must be able to demonstrate that the personal data contained in the advertisement concerned are lawfully published, that is to say, that the data subject has consented to such publication, unless they can rely on another condition laid down in Article 6(1) of the GDPR.”Footnote 55 Significantly, in case of doubt, marketplace operators have to prevent the upload of the content.Footnote 56
ii. Post-publication obligations
As regards the second type of obligation grounded mainly upon Article 32 GDPR, i.e., to implement appropriate technical and organisational security measures to prevent adverts containing sensitive data from being copied and unlawfully published on other websites, it is even harder to make sense of it. The fact that it appears to be an obligation of means, i.e., it is not an obligation to achieve a particular result, does not diminish the interpretative difficulty.Footnote 57 Either the operator makes the determination that the advertiser has a valid legal basis for processing personal data by making such data publicly available, and therefore it is hard to understand why the operator would need to restrict the use of such data for subsequent, third-party use once the data has been made manifestly public.Footnote 58 Or the operator of the marketplace makes the determination that the advertiser has no valid legal basis for processing personal data and therefore no upload should take place, meaning no post-publication obligation is triggered.
A post-publication obligation may make sense once a notification has been received, although even in this context preventing the publication on other websites raises serious practical challenges.Footnote 59 Yet, this is not the situation the CJEU seems to be envisaging.
c. Step three: excluding the applicability of the E-commerce Directive
Step three consists in excluding the applicability of the ECD in the case at hand.
The relationship between the ECD and EU data-protection law has long been the subject of intense debate.Footnote 60 On the face of the ECD, and in particular Article 1 ECD, it seems fairly straightforward to argue that the scopes of the ECD and the Data Protection DirectiveFootnote 61/GDPR are mutually exclusive. Article 1(5)(b) ECD clearly states that “[t]his Directive shall not apply to: … questions relating to information society services covered by Directives 95/46/EC and 97/66/EC.” Recital 14 ECD adds that the protection of individuals with regard to the processing of personal data is solely governed by the Data Protection Directive and the ePrivacy Directive: “the implementation and application of [the ECD] should be made in full compliance with the principles relating to the protection of personal data, in particular as regards unsolicited commercial communication and the liability of intermediaries; [the ECD] cannot prevent the anonymous use of open networks such as the Internet.”Footnote 62
The Data Protection Directive is, unsurprisingly, silent on its relationship with the ECD, as it predates the latter’s adoption. The GDPR, adopted after the ECD, addresses the relationship by providing in its Article 2(4) that the GDPR “shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.”Footnote 63
There are at least two ways to interpret the ECD/GDPR interaction. The first one is a literal interpretation that focuses upon Article 1(5)(b) ECD. This view has not always been adopted by national courts.Footnote 64 The second is a purposive interpretation that focuses upon the objectives of making the GDPR and the ECD compatible. Purposive interpretation is an approach where judges interpret a law in light of the purpose or objective it is intended to achieve, rather than focusing on the literal meaning of the words only. A purposive interpretation would lead to reading the ECD and the Data Protection Directive/GDPR in harmony.
In Russmedia, the CJEU adopts a literal approach, when its AG is in favour of a purposive approach.
For AG Szpunar interpreting cases such as Promusicae Footnote 65 and La Quadrature du Net,Footnote 66 it makes sense to read the ECD and EU data protection law together in cases in which the matters at hand are not governed by specific provisions of the ePrivacy Directive or the GDPR. But when application of the ECD specifically undermines the protection of personal data it must be discarded.Footnote 67 In addition, the AG observes that, although there might be different ways to interpret the GDPR notwithstanding clause, “[t]he EU legislature therefore wanted to emphasise that [the GDPR] does not limit the scope of the specific provisions of [the ECD]. Accordingly, the GDPR cannot be considered to take precedence over [the ECD] on the grounds that it was adopted after that directive.”Footnote 68
For AG Szpunar, the real question is thus whether the GDPR contains a provision that performs a role comparable to that of Article 14(1) ECD.Footnote 69 If such an equivalent provision exists in the GDPR, the ECD does not apply. For reasons that are not entirely clear, the AG refuses to find that Article 82(3) GDPRFootnote 70 could be such a provision.Footnote 71 The most explicit sentence appears in paragraph 185 of the opinion, where the AG states that “it is not clear whether, in the main proceedings, Russmedia’s liability for a breach of the GDPR could arise under Article 82 of that regulation or under national legislation.”Footnote 72 Although the AG’s opinion confirms that there is room for interpretation when reading Articles 1(5)(b) ECD and 2(4) GDPR together, it is not entirely satisfactory as it merely raises doubts regarding the applicability of Article 82.
On the interaction between the ECD and the GDPR, the CJEU refuses to follow its AG. For the Court, the matter is easily solved with two considerations. First, intermediary liability exemptions “cannot interfere with the GDPR regime,” which also applies to platform operators.Footnote 73 Second, Articles 1(5)(b) ECD and 2(4) GDPR are interpreted as meaning that Articles 12–15 ECD may be applicable “for matters other than those relating to the protection of personal data.”Footnote 74
Somewhat surprisingly, however, as if not entirely convinced by the path it had chosen, the CJEU proceeds to examine the effects of Article 15 ECD.Footnote 75 This superfluous check leads the court to state that “the obligation on the operator of an online marketplace to comply with the requirements arising from the GDPR cannot, in any event, be classified as such a general monitoring obligation.”Footnote 76
All in all, even if a literal interpretation of Articles 1(5)(b) ECD and 2(4) GDPR may appear easier to justify, a third path between the approaches taken by the CJEU and its AG remains unexplored. Yet, it does seem possible to construe concepts such as “controllers” and “fault-based liability” in a manner that aligns the GDPR with the ECD. The CJEU, however, declines to pursue this route. As this paper argues, it is precisely this rejection that makes Russmedia a “wicked case,” one that seems well-grounded in principle but is likely to create a series of implementation challenges and may generate more problems than it actually resolves. Yet, at a time of legislative proliferation and growing concern over the complexity of the regulatory framework, it is important to formulate rules that are operational in practice and do not prematurely undermine the credibility of the whole regulatory edifice.
III. A paradigm shift: from notice to upload-level due diligence
Russmedia marks a paradigm shift in platform regulation under the ECD: the focus moves from notice-level due diligence to upload-level due diligence. Admittedly, the judgment is not entirely surprising. It is delivered two years after the entry into force of the DSA, which seeks to move beyond a regime based solely on intermediary liability exemptions and to articulate a broader duty of care for diligent economic operators, particularly when the dissemination of commercial content is at stake. What is problematic, however, is the Court’s blindness to the practical implications of the obligations it identifies, obligations that could carry significant consequences for fundamental rights.
1. Notice-level due diligence before Russmedia
Article 14 ECD is a cornerstone of intermediary liability, establishing a conditional exemption from liability for providers of hosting services.Footnote 77 Prior to Russmedia, the CJEU had, through its case law, articulated a two-pronged test for content monitoring by hosting providers: either the provider receives a notification from which the manifestly unlawful nature of the content emerges, or a court order is issued identifying the scope of the unlawfulness. This emphasis on reactive monitoring stems as a matter of principle from a combined reading of Articles 14 and 15 ECD. Such an emphasis was later on confirmed in pure data protection cases involving search engines.
In early ECD case law, the focus was on notice-level due diligence. L’Oréal v eBay is a case in point.Footnote 78 In this case, the CJEU interpreting Article 14 ECD introduced the standard of the economic diligent operator for determining when a marketplace provider, acting as a hosting provider, could be deemed to be “actually aware of facts or circumstances on the basis of which a diligent economic operator should have identified the illegality.”Footnote 79 In doing so, the CJEU focused upon awareness of facts or circumstances brought to the provider’s attention, typically through prior notice. From paragraph 122 of the judgment, it is clear that what the CJEU had in mind in terms of accepted proactive measure in L’Oréal v eBay was not the systematic and preventive screening of all types of content uploaded on online marketplaces but the systematic screening of notices to detect manifestly illegal content.
In later ECD case law, such as Glawischnig-Piesczek which involved the online social network Facebook, the CJEU required a hosting service provider to remove or block content identical or equivalent, meaning “essentially unchanged,” to material previously declared unlawful by a court order.Footnote 80 In Glawischnig-Piesczek, the CJEU thus did not require the service provider to conduct its own assessment of the lawfulness of content published on its social media service. In Poland v European Parliament and Council of the EU, the CJEU confirmed that the newly introduced liability regime imposed upon online content-sharing service providers in the field of copyright does not impose an obligation to assess the lawfulness of content uploaded by their users.Footnote 81
To be sure, L’Oréal v eBay was not a case about data protection law, just like Poland v European Parliament and Council of the EU. In Glawischnig-Piesczek the CJEU was not asked to interpret data protection law, although the case was about comment deemed harmful to the applicant’s reputation by the national court.
Had the CJEU considered it important both to ensure the GDPR’s full applicability to platform operators and to preserve a notice-level due diligence model in Russmedia, it could have pursued the path charted in Google Spain. That landmark judgment showcases the Court’s interpretative creativity, although there is no attempt in Google Spain to solve for the interaction between the ECD and data protection law. Construing the Data Protection Directive, it held that the operator of a search engine acts as a data controller with respect to a specific set of processing operations: the structuring and making available of search results associated with a data subject’s name.Footnote 82 This can be explained by the decision-making in which a search engine operator engages when designing and deploying its search algorithm, which generates output results on the basis of input search terms.
Importantly, from this qualification, the CJEU was able to find that the data controller was under an obligation to delist search results associated with a data subject’s name upon a legitimate request from the data subject.Footnote 83 What is more, the Court’s reasoning in Google Spain did not seem to support the conclusion that a search engine operator would incur liability whenever the structuring and display of results linked to a data subject’s name contributes to a breach of data protection law. This is explained by the Article 29 Working Party in subsequent guidelines in the following way: “[b]y making a request to one or several search engines the individual is making an assessment of the impact of the appearance of the controverted information in one or several of the search engines and, consequently, makes a decision on the remedies that may be sufficient to diminish or eliminate that impact.”Footnote 84 Google Spain thus reflects a notice-level due diligence paradigm. This means, specifically, a regulatory model in which an intermediary’s legal obligations are triggered primarily upon receiving notice of a specific violation, rather than requiring ex ante monitoring or systematic verification, although obligations may also arise from actual knowledge.Footnote 85 Under this approach, the operator is expected to act diligently, proportionately, and expeditiously after notification, by removing, disabling access to, or delisting unlawful content, but is not subject to general liability for unlawful material absent such notice or actual knowledge. This model thus preserves a reactive compliance framework while maintaining the practical effectiveness of data-protection rights.
Such a model was confirmed a few years after Google Spain, in GC et al v CNIL, in which the CJEU held that it is a data subject’s request that triggers the obligation for search engine providers to comply with Article 9 GDPR strengthening the protection of special categories of personal data.
In Russmedia, the CJEU refuses to follow the path paved in GC et al v CNIL, which dealt specifically with special categories of personal data.
In addition, the Court does not consider an interpretation of Article 82(3) GDPR, read in conjunction with Articles 5(2), 24 and 16, that could have produced a more harmonious reading of the ECD and the GDPR. Yet, the CJEU had already recognised that Article 82 GDPR is based upon a presumption of fault. In ZQ, it held that “[i]t therefore follows from a combined analysis of those various provisions of Article 82 of the GDPR that that article provides for fault-based liability in which the burden of proof rests not on the person who has suffered damage, but on the controller,”Footnote 86 just like the burden of proof of establishing that the conditions for Article 14 ECD liability exemption are met rests upon the platform provider. What the CJEU could have then done was to hold that in order not to be held responsible for the event given rise to the damage, the marketplace operator had to do more than establishing prompt take down: it should have demonstrated that it had implemented design-based measures to guard against the risk of processing of special categories of personal data deemed deeply harmful. Design-based measures are different from content-based obligations, e.g., obligations to assess the lawfulness of content to be uploaded. This brings us to the distinction between design-based and content-based obligations as explored below.
2. Upload-level due diligence after Russmedia
This paper defines upload-level due diligence obligationsFootnote 87 as legal duties imposed on online platforms requiring them to assess and mitigate potential risks associated with user-submitted content before it is published or made accessible through the platform, rather than acting only in response to notifications, complaints or competent-authority orders. Upload-level due diligence obligations are conceptualised as comprising two distinct types: design-based obligations and content-based obligations.
Design-based obligations concern the structuring of a platform’s architecture, interface and default settings in order to prevent or mitigate risks associated with certain categories of user-generated content or user behaviour, without requiring the provider to assess the lawfulness of individual items of content or behaviour. Design-based obligations may therefore require structuring a platform offering services such as matrimonial or escort services in such a way that intimate images are always placed behind a login wall. Another such design obligation could incentivise the making available of default features activating robots.txt protocols to restrict automated scraping or indexing of sensitive content. Additionally, it may require that content fingerprinting or watermarking tools are made available for matrimonial or escort services, with access contingent on the systematic processing of selected attributes of service recipients or third parties flagging manifestly unlawful processing following a pre-determined procedure. It could also require the implementation of privacy-preserving age assurance mechanisms.
By contrast, content-based obligations require the platform to evaluate specific pieces of content before their upload, typically through the use of upload filters or comparable mechanisms.
The ECD does not impose any upload-level due diligence obligations. It does, however, explicitly prohibit general monitoring obligations under Article 15 ECD. As per the CJEU early-ECD case law, a “general monitoring obligation” is an obligation to systematically monitor the contents transmitted by service users. Article 15 ECD is closely linked to Articles 8, 11 and 16 of the Charter of Fundamental Rights of the European Union (EU Charter).Footnote 88 This was explained by the CJEU itself in earlier cases.
In Sabam/Netlog, the CJEU read together Articles 15 ECD and Articles 8, 11 and 16 of the EU Charter.Footnote 89 The CJEU made it clear that the injunction claimed for would have had the effect of forcing the service provider to introduce, for all its customers, in abstracto and as a preventative measure, at its own cost and for an unlimited period, a system for filtering most of the information which was stored on its servers in order to identify files containing protected works, and subsequently that it blocked the exchange of such files. Sabam/Netlog thus implies that upload-level due diligence content-based obligations targeting the entire user base are incompatible with EU law, both under secondary and primary law. Notably, in Glawischnig-Piesczek, the CJEU held that when the monitoring of and search for information are limited to elements specified in a judicial order, and no independent assessment is required on the part of the intermediary service provider, the monitoring obligation is not excessive in the sense of Article 15 ECD.Footnote 90 Therefore, under Glawischnig-Piesczek upload-level content-based due diligence obligations are lawful when triggered by a court order specifying the item of content to be filtered or blocked.
In Russmedia, the CJEU imposed upon the platform provider at stake an obligation to implement measures to prevent ads containing sensitive data first from being published without a proper legal basis, and second, from being copied and unlawfully published on other websites. It is particularly difficult to see how the CJEU would not then be imposing an obligation to introduce, for all its user base, in abstracto and as a preventative measure, at its own cost and for an unlimited period, a system for filtering most of the information that is stored on its servers in order to identify ads containing special categories of personal data, and subsequently that it blocks the publication of such ads in the absence of a proper legal basis.
What is particularly troubling is that, as already raised in the context of the sharing of copyright works, for which relatively sophisticated fingerprinting systems have been developed on the basis of existing catalogues of protected material,Footnote 91 the category of special categories of personal data is particularly difficult to delineate preventively and through automated means.
Article 9 GDPR defines the processing of special categories of personal data as processing “revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.”
In recent cases, the CJEU adopted an extensive interpretation of the concept of special categories of personal data. In OT in an attempt to determine “whether data that are capable of revealing the sexual orientation of a natural person by means of an intellectual operation involving comparison or deduction fall within the special categories of personal data, for the purpose of (…) Article 9(1) of the GDPR,” the CJEU held that “the processing of personal data that are liable indirectly to reveal sensitive information concerning a natural person” shall not be excluded from the scope of the definition.Footnote 92 This thus meant that the publication of information identifying spouses or partners was deemed to be liable to disclose indirectly the sexual orientation of a natural person and thereby within the scope of Article 9 GDPR.Footnote 93
In Lindenapotheke involving transactional data for the purchase of medicinal products, the CJEU made it clear that the purpose or perhaps even the effect of the processing is important for the qualification.Footnote 94 In addition, whether “the processing of those data is capable of revealing information on the health status of a natural person, irrespective of whether that information concerns that user or any other person for whom the user places the order” is sufficient for characterising the data as special categories of personal data.Footnote 95 What about an advert offering for sale a second-hand medical device on an online marketplace? Should the platform provider systematically detect such an advert and conclude that its processing is capable of revealing a health status and perform subsequent investigation with the user advertiser? A positive answer would seem too far reaching.
It is true that, in Russmedia, Articles 11 and 16 of the EU Charter are less directly engaged, since the content at issue is an advert. However, the European Court of Human Right (ECtHR) has consistently acknowledged that commercial expression is in the scope of Article 10 of the European Convention on Human Rights.Footnote 96 This is true even if commercial expression is subject to a different standard of control so that the ECtHR allows national authorities a wider margin of appreciation.Footnote 97 Admittedly, the ECtHR had already moved towards upload-level content-based due diligence in an earlier case involving a news portal.Footnote 98 However, in Delfi the type of content triggering upload-level content-based due diligence is deemed manifestly unlawful hate speech, meaning that the ECtHR was of the view that no “linguistic or legal analysis” was required on the part of the online platform.Footnote 99 What is more, the ECtHR has subsequently limited the scope of its approach.Footnote 100
Notably, the obligations imposed by the CJEU on the platform provider in Russmedia go beyond both mere design-based and mere content-based obligations. A design-based obligation of transparency might have required the systematic collection of a pre-determined set of identifying personal data, whereas a content-based obligation would be limited to preventing the upload of pre-determined categories of content. The obligations imposed by the CJEU in Russmedia are in reality hybrid and amount to adjudicative know-your-user obligations. They thus appear particularly intrusive from the perspective of Article 8 of the EU Charter. In Russmedia, the CJEU holds that the operator of an online marketplace must, before making ads publicly available, not only systematically identify those containing special categories of personal data, but also systematically verify whether the user placing the ad is the data subject concerned or whether the user advertiser can establish an appropriate legal basis for processing such data under Article 9 GDPR to be able to determine whether the processing at stake is unlawful.
Yet, the processing of special categories of personal data is strictly governed under the GDPR: it is in principle prohibited under Article 9(1) GDPR, and a robust data minimisation and confidentiality principle should apply as a matter of principle. What is more, these adjudicative obligations are likely to significantly impact vulnerable data subjects, i.e. those providing escort or other sex-related services.
Effectively, such obligations are reminiscent of practices that some porn platforms implement to process age-related information pertaining to depicted performers and consent releases to prevent image-based sexual abuse.Footnote 101 The procedures put in place by these platforms usually consist in various steps, including ID verification by third parties, content scanning and human moderation, necessitating extensive processing of special categories of data. Considering the character of the contentious content in Russmedia, one could wonder whether the CJEU had the intention to require a similar type of practices for online marketplaces that allow escort or matrimonial ads.
Overall, Russmedia marks a shift towards upload-level due diligence and, as such, represents a significant development. However, by moving beyond design-based obligations and appearing to impose hybrid adjudicative know-your-user duties (going beyond mere content-based duties) on marketplace operators, Russmedia raises more questions than it answers. To further shed light on its practical implications, it is worth considering whether it reflects an attempt to anticipate the DSA.
IV. The state of interplay between the GDPR and the DSA after Russmedia
Although Russmedia only concerns the interaction between the ECD and the GDPR, concepts such as general monitoring or conditional liability exemption are also relevant for the application of the DSA. Therefore, to assess Russmedia’s impact, it is important to revisit the rules governing the interplay between the DSA and the GDPR, with a view to unpack the upload-level due diligence obligations introduced by both instruments, assess their alignment, and determine whether Russmedia anticipates the DSA.
1. The lex complementaria principle as an interpretative principle to resolve tensions between the GDPR and the DSA
Although the DSA builds on the ECD, the DSA’s wording supports a distinct approach to its interplay with the GDPR compared with the ECD.
With the modernisation of the ECD framework through the DSA, the framing of the scope of intermediary liability exemptions has evolved. There is no general exclusion in the DSA of questions governed by the GDPR and the ePrivacy Directive.Footnote 102 Article 2(4)(g) DSA addresses the interaction with the GDPR by providing that the DSA is without prejudice to EU laws regulating other aspects of the provision of intermediary services in the internal market or specifying and complementing the DSA, particularly the GDPR and the ePrivacy Directive.Footnote 103 The interaction between the DSA and the GDPR is therefore now governed by a set of reciprocal “without prejudice” clauses.
What is more, in the data protection circles, there is a growing consensus that the various components of the EU digital rulebook are complementary, a point underscored by the EDPB in its guidelines on the interplay between the DSA and the GDPR.Footnote 104 To quote the EDPB, “[n]onetheless, settled case law of the Court of Justice of the European Union (‘CJEU’) provides that, where two EU legal acts of the same hierarchical value (such as the DSA and the GDPR) do not establish priority of one over the other, they should be applied in a compatible manner, which enables a coherent application of them.”Footnote 105 The EDPB adopts this position despite Recital 10 DSA, in particular its second paragraph, which could be read as an attempt to define the respective scopes of the GDPR and the DSA as mutually exclusive. Such an interpretation is unconvincing, however, as numerous provisions of the DSA incorporate concepts and definitions from the GDPR, and only Article 25(2) DSA expressly excludes the application of the DSA where the GDPR applies.
The bespoke delineation of the scope of the DSA, combined with the emphasis on the complementary relationship between the GDPR and the DSA, indicates that the principle of lex complementaria is emerging as a key interpretative tool, distinct from the traditional lex specialis approach. Under a lex complementaria principle-based approach,Footnote 106 the GDPR and the DSA are treated as mutually reinforcing: each instrument retains its own normative logic, but they are interpreted and applied in a manner that ensures coherence and avoids conflicts. This principle would suggest that obligations under one instrument should be understood in light of the other, promoting a harmonised regulatory environment in which GDPR principles are preserved while the operational rules of the DSA are effectively implemented. Accordingly, it seems reasonable to contend that, although the GDPR is fully applicable to online platforms, reconciliation may be effected through fault-based liability and tailored remedies, as hinted in Section III.1.
2. Aligning upload-level diligence obligations under the DSA and the GDPR
Both the GDPR and the DSA impose upon covered entities upload-level due diligence obligations. When interpreted both in the light of their spirit and the principle of lex complementaria, these obligations appear relatively well aligned: Article 25 GDPR is different from an online safety provision, and Articles 26 and 30 DSA introduce nuanced obligations of means. The expansive stance taken by the CJEU in Russmedia, however, suggests that the Court does more than merely anticipate the DSA, and, that it does so in a rather crude manner.
a. Article 25 GDPR is not an online safety provision
As a matter of principle, the GDPR imposes upon all data controllers an obligation to comply with Article 25 GDPR prior to initiating the processing of personal data.Footnote 107
Data protection by design essentially involves taking proactive steps to integrate data protection principles into (at a minimum) the implementation of processes and systems that handle personal data, from collection to deletion, with a focus on timely risk management. This requires using organisational and technical measures that enhance confidentiality such as pseudonymisation, and minimising the amounts of data collected and processed.
In the GDPR early days, some commentators argued that Article 25 GDPR did not substantially add to the rest of the GDPR, as many of its elements were already implicit in established principles such as data minimisation, purpose limitation and security of processing.Footnote 108 Others, however, viewed data protection by design as the structural backbone of the GDPR, giving concrete operational meaning to its risk-based and accountability-oriented approach by requiring controllers to translate legal principles into technical and organisational measures prior to initiating the processing.Footnote 109 More recent commentaries remain nuanced as regards the effects of Article 25 GDPR: while acknowledging that Article 25 GDPR is largely an implementation mechanism for principles already present in Article 5 GDPR, they highlight divergences among supervisory authorities in their interpretation of the effects of Article 25 GDPR and a reluctance to specify in details what an appropriate measure under Article 25 GDPR should look like.Footnote 110
Interestingly, prior to Russmedia, the CJEU has not been particularly keen on unpacking the effects of Article 25 GDPR. In the Mousse case, the CJEU held for example, without referring to Article 25 GDPR, that the processing of gender does not appear to be either objectively indispensable or essential to enable the proper performance of a contract of train transport. Nor can such processing be regarded necessary to pursue a legitimate interest if the data subjects are not properly informed, or if the processing is not strictly necessary for the objective pursued, or if the processing leads to discrimination risks.Footnote 111
Importantly, if there is one domain where privacy by design has had a noticeable impact in the EU, it is in the digital identity sector. Particularly, it can be observed in the development of national electronic identity schemes and cross-border architecture, for which compliance with core GDPR principles, such as purpose limitation, data minimisation and security, has been a core driver.Footnote 112
Moreover, in light of the recent focus on age-assurance methods, the EDPB has made clear that individual-related attribute disclosure techniques, such as those used to verify age, are not inherently legitimate, and that Article 25 GDPR serves as the benchmark against which their lawfulness must be assessed.Footnote 113 What is more, the implementation of age assurance techniques has already led to significant concerns in several jurisdictions, particularly in the United Kingdom, which is not involved in the EU effort to build a privacy-preserving age verification solution.Footnote 114 GDPR violations in the implementation of age estimation technologies are already being sanctioned.Footnote 115 These considerations underscore the need for a cautious interpretation of Article 25 GDPR, avoiding its use as a basis for imposing new personal data flows. This would then enable a more coherent alignment with DSA obligations.
Yet the CJEU’s formulation in Russmedia appears to overlook the implications of Article 25 GDPR for the wider user base. It almost seems as though Article 25 GDPR has been stripped of its intended purpose, as the Court appears to impose an obligation to systematically intensify the processing of personal data, particularly where sensitive data is at stake and data subjects are likely to be vulnerable.
Importantly, cautioning against transforming Article 25 GDPR into an online safety provision is not to say however that Member States should not be under an obligation to ensure that victims have practical and effective means to identify those responsible for serious online harms.Footnote 116 This should translate into some form of minimum transparency obligations and data access rights of the kind the DSA seeks to establish.
b. Articles 26 and 30 DSA introduce nuanced obligations of means
One important source of due diligence obligations under the DSA is its Article 26.Footnote 117 Under Article 26 DSA, online platform providers that display ads are under transparency obligations, in the form of design-based obligations. More precisely, online platform providers must ensure that each recipient can identify, in a clear, concise, and unambiguous manner, and in real time, when content is an ad.Footnote 118 Online platform providers may use prominent markings to achieve this, potentially following standards set out in Article 44 DSA.Footnote 119 Recipients must also be able to see the natural or legal person on whose behalf the advert is presented, and, if different, the person who paid for it.Footnote 120 In addition, online platform providers must provide meaningful information, easily accessible from the ad itself, about the main parameters used to determine the recipient of the ad and, where applicable, how to modify those parameters.Footnote 121
Crucially, online platform providers must also give service recipients the ability to declare whether the content they provide is or contains commercial communications.Footnote 122 When a service recipient makes such a declaration, the platform must ensure that other recipients can identify, clearly and in real time, that the content is commercial, using prominent markings as appropriate.Footnote 123
Finally, under Article 26(3) DSA online platform providers are prohibited from targeting ads based on profiling using special categories of personal data under Article 9(1) GDPR.Footnote 124
To give effect to Article 26(3) DSA, a combined reading with the GDPR appears necessary, with the GDPR serving to limit the scope and impact of the obligations established under the DSA. Such a combined reading should make it clear that there is no obligation imposed upon online platform providers to process personal data to determine whether the recipient of the service is indeed the data subject to whom the data relate, following a strict data minimisation principle.
Second, Article 26(3) DSA should amount to an obligation of means rather than of results, not to ultimately undermine the prohibition of processing special categories of personal data under Article 9 GDPR. Given the broad definition of special categories of personal data under Article 9(1) GDPR, online platform providers should be required to put themselves in a position to demonstrate they are using their best efforts to comply with Article 26(3) DSA. This could entail adopting both proactive and reactive measures, prohibiting the use of protected characteristics as model features, and perhaps implementing ongoing algorithmic testing and monitoring to address potential proxies in a privacy-preserving way, insofar as it is legitimate for the online platform provider to address discriminatory risks.Footnote 125 Here, an analogy could be drawn with Artificial Intelligence training for which developers are under an obligation of means when processing special categories of personal data, as the French Supervisory Authority seems to suggest in its most recent piece of guidance.Footnote 126
Article 30 DSA goes further than Article 26 DSA in that it imposes upon platform providers allowing consumers to conclude distance contracts with traders a data retention obligation covering a pre-determined set of trader identifying information and a self-declaration by the trader committing to only offer lawful products or services.Footnote 127 Article 30(2) DSA imposes upon covered platforms an obligation of means to perform limited checks to verify reliability and completeness of the information. Ultimately, traders remain responsible for ensuring the accuracy of the information provided and they are given the right to lodge a complaint against account suspension or refusals to create accounts in the first place under Article 30(4) DSA.
When comparing the substance of Article 26 DSA with the outcome of the CJEU ruling in Russmedia, the CJEU appears to be more demanding. The CJEU imposes more than a transparency design-based obligation, as it seems to oblige marketplace operators to perform the identification of service users to determine whether those individuals are the data subjects to whom the data relate. All in all, although under the DSA Russmedia would still be subject to a range of due diligence obligations, including transparency requirements, particularly if it does not qualify as a micro or small enterprise under Recommendation 2003/361/EC,Footnote 128 the DSA appears more balanced than the CJEU ruling in Russmedia and therefore easier to align with Article 25 GDPR.
Similarly, when comparing the substance of Article 30 DSA with the outcome of the CJEU ruling in Russmedia, the CJEU appears to be more demanding. What is at stake in Russmedia is not the conclusion of distance contracts between consumers and traders and in any case it is not clear whether the CJEU implies that service recipients would remain responsible for ensuring the accuracy of the information provided to justify the lawfulness of the service recipient’s activity.
As a result, if the CJEU was seeking to anticipate the application of the DSA through its Russmedia judgment, it thus seems considerably less nuanced in how it formulates upload-level due diligence obligations. It remains to be hoped that greater emphasis on the complementarity between the GDPR and the DSA will allow for a more refined interpretation of Russmedia in subsequent case law.
V. Conclusion
Russmedia represents a significant evolution in the CJEU’s approach to platform regulation under EU law. The judgment shifts the regulatory focus from reactive, notice-level due diligence, exemplified by L’Oréal v eBay and Google Spain, toward proactive, upload-level obligations, requiring online marketplaces to identify and verify content before it is published. While the Court frames these duties in terms of data protection principles, particularly with references to Articles 9 and 25 GDPR, it does so without adequately addressing the practical implications for platform operators or the proportionality of imposing systematic identification verification obligations across all user bases and lawfulness assessment of user activity. This expansive reading risks transforming data protection law into a mechanism for pre-emptive content control, potentially undermining the carefully calibrated balance of fundamental rights that would emerge from a complementary reading of both the GDPR and the ECD/DSA.
Truly, in Russmedia, the CJEU is not primarily concerned with the interests of service users generally, but with the impact upon third parties whose sensitive data are unlawfully processed, resulting in significant harm. This can be explained by the nature of the wrongdoing in Russmedia. The judgment, however, underscores persistent tensions between platform law and data protection law, stemming from its limited attention to practical implementation challenges, its heavy reliance on the category of special categories of personal data to trigger user-base identification verification obligations and lawfulness assessments of user activities, and its narrowing interpretation of general monitoring obligations.
Looking forward and comparing the ECD with the DSA, the emerging principle of lex complementaria offers a framework for reconciling these tensions by interpreting the GDPR and the DSA together. Such reading would suggest that the reasoning in Russmedia as to the interplay between conditional liability exemptions for intermediary services and data protection law may not carry over as is following the repeal of Articles 12–15 ECD and the re-introduction of their counterparts in the DSA.
By treating the GDPR and the DSA as mutually reinforcing, regulators and courts could ensure that obligations under one instrument are interpreted in light of the other, strengthening fundamental rights across different types of populations. In this framework, upload-level due diligence obligations under both the GDPR and the DSA would be understood as obligations of means, not of results, and would be essentially design-based obligations, leading to fault-based liability and tailored remedies rather than blanket monitoring and hybrid adjudicative obligations.
Ultimately, Russmedia teaches us that whenever possible, legal definitions and rules should be formulated with a view to their practical operationalisation, so as to avoid falling into a regime of blame and shame that becomes progressively disconnected from reality and thereby unmanageable. This is because in such a regime, enforcement is likely to become inconsistent, compliance to become symbolic, and accountability to turn selective.
Looking ahead however, the quest for harmonised platform regulation is likely to remain a pressing challenge for the years to come, particularly in light of more recent efforts to narrow down the definition of intermediary service providers and the push back against the principle of origin which continues to live in Article 3 ECD.Footnote 129
Competing interests
The authors declare no competing interests related to this publication.
Open access
