New ruling from Luxembourg breaks with existing principles of platform liability

Platform liability is regularly associated with the well-known notice and take down procedure, which is based on the European principle that platforms can be held liable for illegal content, but only if they have been informed of the content in question beforehand and have had the opportunity to remove the content from the platform immediately. According to the notice and take down procedure, it is therefore sufficient for platform operators to remove illegal content immediately as soon as they become aware of it in order to avoid liability. 

However, in its decision of December 2, 2025 (C-492/23), the ECJ has now given new impetus to the old principles. For data protection violations, there should be exceptions to the notice and take down procedure, at least for operators of online marketplaces. Under certain circumstances, they should also be liable without prior positive knowledge. 

I. Starting point: The "Russmedia" case – setting the course for platform liability? 

The ECJ's decision was triggered by questions referred by the Romanian Court of Appeal "Curtea Apel Clui." In the original proceedings, the plaintiff took action against the operator of an online marketplace on which an unknown third party disseminated defamatory facts about the plaintiff. Specifically, the plaintiff was associated with offering sexual services due to the publications of the unknown third party. However, photos of the plaintiff and her telephone number were also published. The plaintiff informed the operator Russmedia Digital about the publications, whereupon the latter removed the content from the online marketplace within less than an hour. However, the content had already been reproduced in the meantime, so that it could be found on various other websites at the time of deletion. In the proceedings, the plaintiff claimed non-pecuniary damages from Russmedia Digital. She invoked violations of her right to her own image and her honor. In addition, she complained about the unlawful processing of her personal data.

The Romanian courts were unable to agree on how to deal with the case legally. Ultimately, the case ended up before the Court of Appeal in Romania, which decided to refer it to the ECJ.

II. The ECJ ruling 

The ECJ first took a decisive step and did not assess the case according to the provisions of the eCommerce Directive or the DSA, which continued the requirements of the eCommerce Directive, but based its assessment on data protection law and, more specifically, on the GDPR. It then found that the plaintiff's data published by the unknown third party was indeed personal data within the meaning of Art. 4 (1) GDPR. The ECJ even considered it to be sensitive data under Art. 9 GDPR, as the content also concerned the plaintiff's sex life.

Another decisive factor was the assessment of responsibility, in this case whether Russmedia Digital should also be classified as a joint controller under Article 4(7) GDPR. From the perspective of the ECJ, this is to be affirmed and follows from the fact that Russmedia Digital grants itself all rights in its general terms and conditions, including the use, distribution, reproduction, and deletion, without giving a valid reason, of the content published on the online marketplace. While the unknown third party is primarily responsible, according to the ECJ, Russmedia Digital can at least be held jointly responsible.

This joint responsibility means that platform operators will in future be required to identify and monitor illegal content before it is published. In addition, according to the ECJ, a check should be carried out to ensure that the content to be uploaded can actually be attributed to the person publishing it. Finally, the ECJ also stipulates that the identities of all persons authorized to publish content must be recorded and verified by the operator of an online marketplace.

Even more far-reaching is the ECJ's final requirement that operators of online marketplaces must actively prevent publications containing sensitive data from being reproduced and disseminated on other websites. 

The ruling therefore sends a decisive message to operators of online marketplaces: as soon as there are violations of the Data Protection Regulation, in particular Art. 9 GDPR, operators must act even before the illegal content is published. The key difference is that the liability privilege of platforms, which generally provides for liability only after positive knowledge of the illegal content, does not apply in the case of data protection violations.

III. BGH: The Renate Künast case 

The ECJ's decision is also interesting in light of the legal dispute between former Consumer Protection Minister Renate Künast and the mega-corporation Meta. The BGH had suspended the proceedings to await the ECJ's decision in the Russmedia case (BGH decision of February 18, 2025 – VI ZR 64/24). Ms. Künast was initially successful in the first instance before the Regional Court of Frankfurt am Main, but on appeal she was only granted injunctive relief, not damages. However, both courts assumed that the assessment of the case was subject to the principles of liability for interference developed by the Federal Court of Justice. It was only when the case was brought before the Federal Court of Justice that the latter recognized that the case fell under data protection law. In this respect, the Federal Court of Justice considered it appropriate to suspend the proceedings for the time being.

The wait may have been particularly worthwhile for Ms. Künast, as the ECJ has already ruled that Meta bears joint responsibility for the personal data on its various platforms (ECJ ruling of June 5, 2018 - C-210/16) and, on the other hand, the ECJ has, with its new decision, virtually ruled out the possibility that Meta can successfully invoke liability privileges under Art. 6 DSA.  In this respect, Ms. Künast is moving forward with tailwinds from Luxembourg to the final instance before the Federal Court of Justice.  
You can read more about the Renate Künast case here.

IV. Practical advice 

In practice, the ECJ's decision means in particular that operators of online marketplaces should check as soon as possible whether they are responsible under data protection law for the personal data of third parties published on their sites. If this is the case, ongoing monitoring of the lawful processing of personal data is both advisable and necessary. Consequently, proactive behavior on the part of platform operators is required. They can no longer invoke mere ignorance and the notice and take down procedure under the DSA with regard to data protection violations. The ECJ has made this clear.