LEGAL NEWS IN THE SPOTLIGHT | The CJEU on the liability regime of online platforms for third-party advertisements

On 2 December 2025, the Court of Justice of the European Union (CJEU) delivered a landmark judgment in case case C-492/23 (X v Russmedia Digital SRL and Inform Media Press SRL), clarifying the role and responsibilities of internet service providers (ISPs) in relation to advertisements published on their online platforms.

The case concerned a Romanian online marketplace that allowed third parties to publish advertisements on its website in return for a fee. An unidentified third party published a fake advertisement portraying a woman as offering sexual services, including her photographs and telephone number, without her consent. The woman brought an action against the platform operator, seeking compensation for non-material damage on the grounds that the publication infringed her rights to personal portrayal, honour, reputation, privacy and personal data protection.

The referring court asked the CJEU whether a hosting service provider could be held liable under the GDPR for unlawful content uploaded by third parties and, in particular, whether such a provider was required to verify, prior to publication, whether the advertisements were unlawful or infringed existing data protection rules. The CJEU was also asked to determine whether the liability exemptions set out in Articles 12 to 14 of Directive 2000/31/EC (e-Commerce Directive) applied where the ISP merely made the platform available, did not claim ownership of the content, but retained certain rights over its use.

The CJEU held that, in the circumstances of the case, the ISP cannot rely on the liability exemption provided for under Directive 2000/31/EC and qualifies as a data controller, within the meaning of Article 4 of GDPR, in respect of the personal data contained in advertisements published on its platform. As a result, the ISP is required to implement appropriate technical and organisational measures to verify, prior to publication, that such advertisements are lawful and do not infringe data protection rules or the fundamental rights of the individuals concerned.

Newsletter n. 113 – December 2025