This paper examines the Court of Justice of the European Union’s (CJEU) December 2025 judgment in Russmedia, which marks a significant shift in EU platform regulation. Departing from the reactive, notice-level due diligence model established in L’Oréal v eBay and Google Spain, the Court imposes proactive, upload-level obligations on online marketplace operators, grounding them in the GDPR provisions on special categories of personal data and data protection by design. The paper unpacks the Court’s three-step reasoning in what appears to be a wicked case: its expansive characterisation of the marketplace operator as a data controller, its imposition of pre- and post-publication obligations, and its literal interpretation of the relationship between the E-Commerce Directive and the GDPR. It argues that while the judgment responds to legitimate concerns about serious online harms to third parties, it imposes hybrid adjudicative know-your-user duties that raise significant proportionality and fundamental rights concerns. The paper further evaluates Russmedia’s compatibility with the Digital Services Act, contending that the emerging principle of lex complementaria offers a more balanced framework. It concludes that upload-level due diligence obligations should be understood as design-based obligations, not blanket monitoring or adjudicative requirements.