The Court of Justice of the European Union (“CJEU”) recently delivered two judgments with great significance for the passive hosting safe harbour under the Digital Services Act (“DSA”)
In joined cases Case C-188/24 and Case C-190/24 WebGroup Czech Republic and NKL Associates and Coyote System, the CJEU provided clarification on the impact of algorithms on the scope of the hosting exemption under Article 14 of Directive 2000/31/EC, the e-Commerce Directive, with important implications also for its successor, the DSA. In case C-421/24 AGCOM v Google Ireland the CJEU applied this earlier decision, as well as establishing the impact of commercial partnership agreements on the hosting exemption.
WebGroup Czech Republic and NKL Associates and Coyote System
In these joined cases, the CJEU considered in what scenarios a provider of an intermediary service can be liable for content that is shared by its users. Article 14 exempts service providers from liability for user-stored illegal content, provided the provider does not have actual knowledge of the illegal activity and takes action to remove or disable access to the illegal content immediately upon gaining actual knowledge of it.
This hosting exemption is disapplied where the service provider has knowledge of or control over the information stored. Based on the judgment of the CJEU, the provider of an intermediary service that actively determines how user content is distributed through algorithmic decision making may fall outside the scope of the exemption, even where the provider does not have knowledge of the content. This raises particular concerns for social media platforms that rely heavily on algorithms to suggest specific content.
Background
These joined cases both relate to illegal content being hosted on the defendants’ websites. The referrals required the CJEU to interpret the scope of the e-Commerce Directive, the predecessor to the DSA. The French Council of State referred three key questions to the CJEU in each of the joined cases, though it is specifically the third question in the Coyote System case which is likely to have wide-reaching effect. This question relates to the hosting safe harbour for liability under the e-Commerce Directive (and the DSA) and involved an assessment of the circumstances in which a service provider could be liable for user-generated content, and where they could be positively obligated to take action to remove such content.
In Case C-190/24, Coyote System argued that a prohibition on rebroadcasting user-generated alerts infringed Articles 14 and 15 of the e-Commerce Directive because it effectively imposed positive monitoring obligations on a neutral host. The CJEU considered whether the operator could rely on Article 14 and, if so, whether the prohibition conflicted with the ban on imposing general monitoring obligations under Article 15. While these cases both relate to French legal requirements, this analysis of the CJEU will have an impact throughout the EU.
The judgment
Neutral vs active role of the online service provider
Article 14 of the e-Commerce Directive states that a provider of an information society service consisting of storage of information supplied by a recipient of the service is exempt from liability where the provider has no actual knowledge of illegal activity or information and acts promptly to remove or disable access once such knowledge is obtained. Under this exemption, passive hosting service providers should not be liable for information supplied by users where they lack knowledge or control over that information. While the e-Commerce Directive has been superseded by the DSA today, this exemption was maintained at Article 6 DSA, together with Recital 18.
Citing earlier decisions in L’Oréal and eBay and YouTube and Cyando, the CJEU confirmed that Article 14 only exempts providers whose activities are limited to the technical storage of information supplied by users. Once the provider exercises knowledge of or control over the stored information, it no longer performs a “neutral role” and cannot rely upon the hosting safe harbour. Recital 42 of the e-Commerce Directive, as replicated in Recital 18 of the DSA, further explains that liability exemptions apply only where the activity of the service provider is of a “mere technical, automatic and passive nature”.
It is important to note that the two conditions, knowledge and control, are separate requirements. A service provider which controls the stored information may fall outside the scope of the exemption even where it has no actual knowledge of that illegal information, and vice versa. This includes scenarios where control is through an automatic algorithm implemented by the service provider. Referring to the Advocate General’s Opinion, the CJEU held that a provider may exercise control through a predetermined algorithm whose conditions determine whether to or by selection, broadcast user-generated information. In those circumstances, it is irrelevant that the service provider does not intervene to promote, modify or delete information. However, not every automated process can be said to result in the service provider falling outside of the exemption. The CJEU provided a distinction between automated processes that have “mere categorisation and indexation” conditions and those through which the service provider exercises control over user-generated information. Whether a provider performs an active role remains a matter for the national court to determine in light of the operation of the service concerned.
This approach does not overturn the previous finding in the Youtube and Cyando decision (which is in fact cited by the CJEU), that the hosting safe harbour may still apply where a platform recommends videos on the basis of users’ profiles or preferences. Basic recommendation, categorisation and indexation functions remain compatible with a neutral role. The distinction drawn by the recent judgments is narrower: a provider only loses the exemption where its algorithm goes beyond such functions to determine, in its own interest, the conditions, manner or priority in which content is broadcast. Whether a given recommendation system or commercial arrangement with content creators crosses that line, and so compromises the provider’s neutral role, will therefore depend on the specific facts.
General monitoring obligations
The CJEU also clarified the relationship between Articles 14 and 15 of the e-Commerce Directive, specifically regarding the prohibition on Member States imposing general monitoring obligations on providers of intermediary services to monitor the information they transmit or store or actively to identify unlawful activity. This prohibition on general monitoring obligations has been retained in Article 8 DSA. Where a provider no longer satisfies the conditions for the hosting safe harbour, the provider cannot rely on Article 15 to challenge monitoring obligations under national law. The prohibition on general monitoring is not a free-standing protection available to every online platform. Rather, it is dependent on whether the provider continues to perform the role of a neutral intermediary.
Additionally, where the hosting exemption does apply, this does not prevent national courts or public authorities from requiring the provider to terminate or prevent specific infringements which they identify. Article 14(3) reserves the power of courts and administrative authorities to order the removal of illegal content, disable access to unlawful material or prevent future infringements.
The CJEU also confirmed that targeted obligations directed at specific unlawful content do not amount to prohibited general monitoring. A service provider is not subject to a general monitoring obligation where it can automatically identify and block identified illegal information or equivalent content, since this does not require it to monitor all of the information it stores. Notably, the judgment confirms that Member States are not prevented from prohibiting the rebroadcasting of information about certain roadside checks on “grounds of public policy, security or safety”.
AGCOM V Google Ireland
The CJEU has since applied many of the principles from the Coyote System judgment in Case C-421/24 AGCOM v Google Ireland. The case concerned Google’s operation of YouTube and whether the platform could rely on the hosting exemption in relation to videos promoting gambling on its platform.
Background
The case concerned an Italian restriction on gambling advertising, including indirect advertising. On the basis of this restriction, the Italian regulator fined Google for allowing the promotion of gambling on YouTube through videos encouraging users to share videos of their gambling winnings published by five content creators which were part of the YouTube Partner Programme. As in Coyote Systems, a question arose as to whether it was correct, as a matter of EU law, to hold Google liable for content hosted on its platform.
The judgment
The CJEU, citing Coyote System, noted that the requirement of knowledge and control under Recital 42 of the e-Commerce Directive are alternatives and are independent of one another. While the CJEU focused on the concept of control in assessing the impact of algorithms in Coyote System, it was the concept of knowledge which was the focus of the AGCOM judgment.
The CJEU found that an operator of an online video sharing platform could not rely on the hosting exemption where, in connection with a commercial partnership agreement providing for the sharing of advertising revenue, it examined the content of a creator’s channel, including its main theme, most viewed videos, newest videos and metadata. The CJEU determined that this examination gave the platform knowledge of the essential content of the channel and meant that it could no longer be regarded as performing a merely technical, automatic, and passive role.
Therefore, where a platform enters into such commercial partnership agreements with content creators, it will no longer be able to rely on the hosting exemptions contained in Article 14 of the e-Commerce Directive / Article 6 of the DSA.
Commentary
In both judgments, the CJEU focused solely on the rights and obligations of the service provider, without any discussion regarding who created the illegal content itself. It should be remembered that even where providers cannot rely on the hosting safe harbour, the content creator may remain solely or jointly liable for the content they created.
While the judgments of the CJEU both focused on e-Commerce Directive, as previously noted the “knowledge” or “control” language which was at issue is maintained in the DSA. Therefore, while it is uncertain how the CJEU will interpret the hosting exemption in the context of the DSA, there is a possibility that the same interpretation will be carried across to the DSA, the CJEU’s interpretation therefore continues to be highly relevant for online platforms operating within the European Union.
For social media platforms, content-sharing services and other digital platforms, the decision signifies that the availability of the hosting exemption depends not on the origin of the content but on the provider’s own role in relation to that content. Platforms that merely store information supplied by users are more likely to benefit from the exemption. However, where providers organise, prioritise, recommend or otherwise influence the dissemination of user-generated content, they potentially expose themselves to liability. As digital platforms increasingly rely on algorithms to determine how users discover content, organisations should carefully assess whether their activities remain consistent with the passive and neutral role required for the intermediary liability exemptions to apply.
The AGCOM judgment provides a practical illustration of how these principles may operate in practice. The CJEU distinguished between the standard operation of an online platform and the additional involvement arising from a commercial partnership with content creators. Where a platform goes beyond merely hosting content by reviewing a creator’s channel and assessing its content as part of a revenue sharing arrangement, it may acquire knowledge of the essential content of the material hosted.
It is important to note, that falling outside of the hosting exemption does not automatically make the online platform liable for any illegal content posted on their site. Instead, it means that the platform must defend itself from liability under more traditional liability rules. There would still be arguments to be made regarding fault, causation, illegality etc which could be argued in any proceedings. Proceedings are also likely to be taken against the service provider due to a perception that they have greater resources to pay damages compared to the creator of the illegal content. This would of course result in increased legal costs for the platform provider, and it would be sensible for organisations to consider how this decision may affect their position going forward.
Each case now returns to the respective national courts in order to determine any liability faced by the online platforms, drawing on the clarifications provided by the CJEU.
Conclusion
Organisations should also consider how this latest development sits alongside the previous CJEU decision in Case C-492/23, Russmedia Digital SRL and Inform Media Press SRL (as previously discussed here). In the Russmedia decision, delivered by the Grand Chamber on 2 December 2025, the CJEU determined that a marketplace operator cannot rely on exemptions under the e-Commerce Directive (or its successor, the DSA), to avoid potential liability under GDPR for content posted on their platform.
Taken together, these three judgments illustrate two distinct pressures on the hosting exemption. Coyote System and AGCOM narrow the exemption’s own scope, by broadening what counts as ‘knowledge’ or ‘control’ so that fewer providers qualify as neutral hosts in the first place. Russmedia confirms that even a provider cannot invoke the hosting exemption to avoid separate obligations arising under the GDPR, since the exemption was never intended to interfere with the GDPR regime.
Contact Us
For more information regarding the Digital Services Act, or data protection generally, please contact any member of our Technology and Innovation Group or your usual Matheson contact.
