--- title: "Toward a Two-Tier Liability Regime for Online Platforms? Analysis of the CJEU’s Russmedia Decision" id: "2989" type: "post" slug: "toward-a-two-tier-liability-regime-for-online-platforms-analysis-of-the-cjeus-russmedia-decision" published_at: "2025-12-08T08:23:56+00:00" modified_at: "2026-03-03T09:49:30+00:00" url: "https://augustdeboustg.wpenginepowered.com/en/legal-article/toward-a-two-tier-liability-regime-for-online-platforms-analysis-of-the-cjeus-russmedia-decision/" markdown_url: "https://augustdeboustg.wpenginepowered.com/en/legal-article/toward-a-two-tier-liability-regime-for-online-platforms-analysis-of-the-cjeus-russmedia-decision.md" taxonomy_category: - "Legal Article" taxonomy_language: - "English" taxonomy_post_translations: - "pll_6980eae3b2783" taxonomy_tax_expertise: - "Personal Data and Cybersecurity" taxonomy_tax_secteur: - "Tech & Digital" --- Menu Interagir avec notre IA Practice Areas (66) Transactional- [Artificial intelligence](https://augustdeboustg.wpenginepowered.com/en/expertise/artificial-intelligence/) - [Capital Markets](https://augustdeboustg.wpenginepowered.com/en/expertise/capital-markets/) - [Commercial and International Contracts](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-and-international-contracts/) - [Commercial Contracts and Strategic Partnerships](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-contracts-and-strategic-partnerships/) - [Competition Law, European Regulation and FDI](https://augustdeboustg.wpenginepowered.com/en/expertise/competition-state-aid/) - [Consumer, Marketing & Advertising](https://augustdeboustg.wpenginepowered.com/en/expertise/distribution-and-consumer-law/) - [Financing](https://augustdeboustg.wpenginepowered.com/en/expertise/financing/) - [Foreign Investment Control](https://augustdeboustg.wpenginepowered.com/en/expertise/foreign-investment-control/) - [Go-to-Market](https://augustdeboustg.wpenginepowered.com/en/expertise/go-to-market/) - [Intellectual Property](https://augustdeboustg.wpenginepowered.com/en/expertise/intellectual-property/) - [International Trade](https://augustdeboustg.wpenginepowered.com/en/expertise/international-trade/) - [Labor and Social Security Law](https://augustdeboustg.wpenginepowered.com/en/expertise/labor-and-social-security-law/) - [Mergers-acquisitions](https://augustdeboustg.wpenginepowered.com/en/expertise/mergers-acquisitions/) - [Patents](https://augustdeboustg.wpenginepowered.com/en/expertise/patents/) - [Personal Data and Cybersecurity](https://augustdeboustg.wpenginepowered.com/en/expertise/personal-data-and-cybersecurity/) - [Private equity](https://augustdeboustg.wpenginepowered.com/en/expertise/private-equity/) - [Projects and Infrastructure](https://augustdeboustg.wpenginepowered.com/en/expertise/projects-and-infrastructure/) - [Public Procurement](https://augustdeboustg.wpenginepowered.com/en/expertise/public-procurement/) - [Real Estate and Construction](https://augustdeboustg.wpenginepowered.com/en/expertise/real-estate-and-construction/) - [Restructuring](https://augustdeboustg.wpenginepowered.com/en/expertise/restructuring/) - [Securities Law](https://augustdeboustg.wpenginepowered.com/en/expertise/securities-law/) - [Tax](https://augustdeboustg.wpenginepowered.com/en/expertise/tax/) - [Tech And Digital](https://augustdeboustg.wpenginepowered.com/en/expertise/tech-and-digital/) Dispute Resolution- [Administrative and Public Law Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/administrative-and-public-law-litigation/) - [Arbitration and ADR](https://augustdeboustg.wpenginepowered.com/en/expertise/arbitration-and-adr/) - [Class Actions](https://augustdeboustg.wpenginepowered.com/en/expertise/class-actions/) - [Commercial and Corporate Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-and-corporate-litigation/) - [Competition Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/competition-consumer-and-distribution-litigation/) - [Constitutional Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/constitutional-litigation/) - [Defective Products and Insurance Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/defective-products-and-insurance-litigation/) - [Employment and Social Security Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/employment-and-social-security-litigation/) - [Environmental and ESG Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/environmental-and-esg-litigation/) - [European Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/european-litigation/) - [Insolvency and Restructuring](https://augustdeboustg.wpenginepowered.com/en/expertise/insolvency-and-restructuring/) - [Intellectual Property, Media, and Press Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/intellectual-property-media-and-press-litigation/) - [Patent Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/patent-litigation/) - [Real Estate, Construction, and Land Use Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/real-estate-construction-and-land-use-litigation/) - [Securities Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/securities-litigation/) - [Tax litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/tax-litigation/) - [Tech, Digital and Data Litigation](https://augustdeboustg.wpenginepowered.com/en/expertise/tech-digital-and-data-litigation/) - [White-Collar Crime and Investigations](https://augustdeboustg.wpenginepowered.com/en/expertise/white-collar-crime-and-investigations/) Advisory- [Artificial intelligence](https://augustdeboustg.wpenginepowered.com/en/expertise/artificial-intelligence/) - [Commercial Contracts and Strategic Partnerships](https://augustdeboustg.wpenginepowered.com/en/expertise/commercial-contracts-and-strategic-partnerships/) - [Consumer, Marketing & Advertising](https://augustdeboustg.wpenginepowered.com/en/expertise/distribution-and-consumer-law/) - [Go-to-Market](https://augustdeboustg.wpenginepowered.com/en/expertise/go-to-market/) - [Governance and Corporate Law](https://augustdeboustg.wpenginepowered.com/en/expertise/gouvernance-et-droit-des-societes/) - [Insurance Law](https://augustdeboustg.wpenginepowered.com/en/expertise/insurance-law/) - [Intellectual Property](https://augustdeboustg.wpenginepowered.com/en/expertise/intellectual-property/) - [Labor and Social Security Law](https://augustdeboustg.wpenginepowered.com/en/expertise/labor-and-social-security-law/) - [Patents](https://augustdeboustg.wpenginepowered.com/en/expertise/patents/) - [Private Clients](https://augustdeboustg.wpenginepowered.com/en/expertise/private-clients/) - [Tax](https://augustdeboustg.wpenginepowered.com/en/expertise/tax/) - [Tech And Digital](https://augustdeboustg.wpenginepowered.com/en/expertise/tech-and-digital/) Regulatory- [Competition Law, European Regulation and FDI](https://augustdeboustg.wpenginepowered.com/en/expertise/competition-state-aid/) - [Compliance and Investigations](https://augustdeboustg.wpenginepowered.com/en/expertise/compliance-and-investigations/) - [Digital and Technology Regulation](https://augustdeboustg.wpenginepowered.com/en/expertise/digital-and-technology-regulation/) - [Digital Assets](https://augustdeboustg.wpenginepowered.com/en/expertise/digital-assets/) - [Environmental and Urban Planning Law](https://augustdeboustg.wpenginepowered.com/en/expertise/environmental-and-urban-planning-law/) - [ESG](https://augustdeboustg.wpenginepowered.com/en/expertise/esg/) - [European Law](https://augustdeboustg.wpenginepowered.com/en/expertise/european-law/) - [International Sanctions and Export Controls](https://augustdeboustg.wpenginepowered.com/en/expertise/international-sanctions-and-export-controls/) - [International Trade](https://augustdeboustg.wpenginepowered.com/en/expertise/international-trade/) - [Personal Data and Cybersecurity](https://augustdeboustg.wpenginepowered.com/en/expertise/personal-data-and-cybersecurity/) - [Product Compliance and Safety](https://augustdeboustg.wpenginepowered.com/en/expertise/product-compliance-and-safety/) - [Public Law](https://augustdeboustg.wpenginepowered.com/en/expertise/public-law/) - [Securities Law](https://augustdeboustg.wpenginepowered.com/en/expertise/securities-law/) Sectors (13) - [Aerospace and Defense](https://augustdeboustg.wpenginepowered.com/en/secteur/aerospace-and-defense/) - [Banking & Finance](https://augustdeboustg.wpenginepowered.com/en/secteur/banking-finance/) - [Data Centers](https://augustdeboustg.wpenginepowered.com/en/secteur/data-centers/) - [Energy](https://augustdeboustg.wpenginepowered.com/en/secteur/energy/) - [Health and Life Sciences](https://augustdeboustg.wpenginepowered.com/en/secteur/health-and-life-sciences/) - [Infrastructure Projects](https://augustdeboustg.wpenginepowered.com/en/secteur/infrastructure-projects/) - [Luxury And Retail](https://augustdeboustg.wpenginepowered.com/en/secteur/luxury-and-retail/) - [Manufacturing](https://augustdeboustg.wpenginepowered.com/en/secteur/manufacturing/) - [Media](https://augustdeboustg.wpenginepowered.com/en/secteur/media/) - [Real Estate & Construction](https://augustdeboustg.wpenginepowered.com/en/secteur/real-estate-construction/) - [Sport](https://augustdeboustg.wpenginepowered.com/en/secteur/sport/) - [Tech & Digital](https://augustdeboustg.wpenginepowered.com/en/secteur/tech-digital/) - [Telecommunications & Digital Infrastructure](https://augustdeboustg.wpenginepowered.com/en/secteur/telecommunications-digital-infrastructure/) Cet article résumé en une minute avec l’IA In a decision delivered on 2 December 2025, the Court of Justice of the European Union held an online marketplace liable for the unlawful processing of sensitive personal data published in a user’s listing. The Court ruled that the operator qualifies as a data controller for the processing of personal data contained in listings published on its platform and must, prior to publication, verify whether these listings include sensitive data and whether such processing complies with the GDPR. Although the facts predate the Digital Services Act, the Court’s reasoning would very likely apply equally today. **Facts** An online marketplace operator allowed users, essentially in Romania, to publish classified ads for the sale of goods or services. An anonymous user posted an ad offering sexual services allegedly provided by a third party. The listing included photographs of that person as well as her contact details. The person concerned notified the platform, which promptly removed the content. However, before the removal, the ad had been copied and reposted on other websites beyond the marketplace operator’s control. As a result, the data remained available online despite the original platform’s withdrawal. **Marketplace Operator Qualifies as Controller** The Court confirmed the approach outlined earlier by the European Data Protection Board in its guidelines on the interplay between the DSA and the GDPR. According to the Court, a platform operator generally acts as data controller for the personal data processed within the service it provides. Several factors support this finding: - The listing is made available online solely because of the platform’s service. - The operator pursues its own purposes, including commercial and advertising objectives, and does not merely provide a technical service. - It determines essential means of the processing such as presentation, publication period, categories and ranking, and conditions of dissemination. The operator and the advertiser therefore act as joint data controllers for the processing of personal data contained in the listings. **Pre-Publication GDPR Review Required** As data controller, the operator must comply with the obligations set out in Articles 24 and 25 GDPR. It must identify potential risks arising from the processing of personal data and implement appropriate measures and safeguards in light of those risks. This obligation applies upstream, at the design stage of the service (“privacy by design” approach). The Court emphasized that the publication of personal data on a platform carries a high risk because the information can be copied, disseminated and accessed on other sites without any control. The data subject may lose anonymity and control over the use of his or her data, with potentially serious consequences, particularly when the data processed is sensitive. The CJEU held that the operator must therefore, before publication: - **Detect** whether a listing contains sensitive personal data. - **Verify** whether the data relates to the advertiser or whether the advertiser benefits from a relevant derogation, **such as the explicit consent**of the person concerned. - **Refuse** **publication** where these conditions are not met. As part of its security obligations, the operator must also implement measures designed to limit the unlawful copying and reproduction of listings containing sensitive personal data. **Intermediary Liability Exemptions Do Not Apply to GDPR** The Court reiterated that the E-Commerce Directive(and now the DSA) provides a limited liability regime for intermediary service providers, including an absence of a general monitoring obligation and a requirement to remove illegal content expeditiously once they become aware of it. However, Article 1 of the E-Commerce Directive excludes data protection matters, which fall under the GDPR’s separate liability framework. As a result, an operator cannot rely on the intermediary liability exemptions to avoid its obligations as data controller. The two regimes coexist, but the liabilities they establish remain distinct. **Practical Implications** Although legally coherent, the judgment introduces uncertainty for platform operators. It may amount to another step away from the prohibition of general monitoring, similar to the requirements introduced under the Copyright Directive for content sharing platforms regarding user-uploaded content. Several practical challenges arise from this decision: - The content of listings is determined freely by users. - The notions of personal data and sensitive data are broad, making detection difficult and wide scale filtering mechanisms likely to trigger unjustified refusals to publish. - Automated filtering tools may qualify as automated decision making within the meaning of Article 22 GDPR, creating operational and human resource burdens for operators. The judgment therefore imposes a multi-layer liability framework on platforms, which they will need to manage depending on the nature of the content published. Share - Linkedin - Copy Link Cet article résumé en une minute avec l’IA ### Authors 2 - [Florence Chafiol](https://augustdeboustg.wpenginepowered.com/en/collaborateur/florence-chafiol-2/) - [Robin Nini](https://augustdeboustg.wpenginepowered.com/en/collaborateur/robin-nini-2/) ### Practice Area 1 - [Personal Data and Cybersecurity](https://augustdeboustg.wpenginepowered.com/en/tax-expertise/personal-data-and-cybersecurity/) ### Sector 1 - [Tech & Digital](https://augustdeboustg.wpenginepowered.com/en/tax-secteur/technologie-et-digital_en/) ## Discover more content that might interest you News [10/10/24 Legal Article 4 min GDPR and AI: A Case Study of Extraterritorial GDPR Application with Clearview AI Decisions By three decisions issued by the Italian, French, and Dutch data protection authorities, Clearview AI has been sanctioned for numerous violations of the GDPR. Beyond the violations committed by the company, these decisions illustrate the broad extraterritorial scope of the GDPR, which applies to a company that (i) has no… Read more](https://augustdeboustg.wpenginepowered.com/en/legal-article/gdpr-and-ai-a-case-study-of-extraterritorial-gdpr-application-with-clearview-ai-decisions/)