The Court of Justice of the European Union has taken a significant step in redefining the role of digital platforms.
In its judgment of 2 December 2025 in Case C-492/23 (Russmedia Digital), the Court addressed a key question: to what extent can a platform claim to be detached from the consequences of the data processing it enables?
The operator of an online marketplace can no longer rely on technical neutrality when the publication of content involves the processing of personal data, particularly sensitive data.
Accountability arises upstream, at the level of service design and the foreseeability of risks. Viewed in this light, the ruling aligns with the Digital Services Act and anticipates the risk-based approach of the AI Act, outlining a model of data governance grounded in responsible design.
Facts
In 2018, an anonymous user posted a false advertisement on an online marketplace operated by Russmedia, offering sexual services in the claimant’s name. The advertisement included the victim’s phone number and photographs, which had been published without her consent.
The platform removed the advertisement less than an hour after it was reported, but the content had already been copied and reproduced on other websites. The claimant subsequently brought legal action seeking compensation for non-material damage, arguing that the platform was liable for violations of the GDPR.
The platform defended itself by claiming that its role was purely technical and invoking the hosting service liability exemption provided under the E-Commerce Directive.
