Russmedia: 30 + 3 Questions Answered

I. What is the case about? 

1. What happened in Russmedia (C-492/23)? 

An anonymous user posted a fake sex ad using a woman’s real photo and phone number. Russmedia removed it within an hour, but the woman sued for personality rights and GDPR violations. 

2. Why did a fake ad trigger a landmark ruling? 

Because the claimant framed the harm as a GDPR violation, forcing the Court to decide whether a platform that hosts user ads is only a passive intermediary, or also a GDPR controller for the personal data in those ads (especially where the content contains sensitive data and causes serious harm). 

3. What did the CJEU decide? 

That an online marketplace or advertising platforms can be a (joint) controller of personal data contained in user ads and cannot rely on safe harbour to escape GDPR obligations. In practice, this means that safe harbour may no longer provide a reliable shield where personal data is involved. 

4. Why was removal within an hour not enough? 

Because GDPR imposes ex ante compliance duties; notice-and-takedown does not exhaust a controller’s obligations. 

5. What legal conflict was at stake? 

A fundamental tension between platform liability rules (under e-commerce directive) – reactive, notice and take down and GDPR – proactive, risk-based, and preventive. 

The conflict arises because the same piece of content can trigger both regimes, but the GDPR may set stricter standards. 

6. Why is it called a “safe harbour killer”? 

Because critics read the judgment as sharply weakening, and potentially in some readings gutting, the traditional host-provider immunity whenever unlawful user content can be framed as a data-protection violation. That is why commentators say it may shift platforms from notice-and-takedown to broad pre-screening and risk-heavy compliance. Some authors, though, caution that its reach in the DSA era may be narrower or uncertain. 

II. Joint controllership 

7. Why was Russmedia a (joint) controller? 

Because it participated in determining the purposes and means of processing together with the user. It enabled and structured publication, set parameters of processing, and pursued its own commercial purposes. 

For businesses this means that standard platform features (categorization, display, monetization) can be enough to trigger controllership. 

8. Is making content available enough to determine “means”? 

Potentially yes. If a platform defines how content is uploaded, organized, and shown, the Court may view this as determining the “means” of processing. This sets a relatively broad, context-dependent threshold. 

9. How important were the Terms of Use? 

They were relevant but not decisive. The Court referred to the platform’s contractual framework as evidence of its role, but the analysis ultimately rested on actual involvement in the processing rather than formal clauses alone. 

10. Would narrower Terms of Use have changed the outcome? 

Unclear. The judgment leaves open whether contractual breadth was decisive or merely confirmatory. The Court did not present the measures identified in the case as universally applicable to all platforms. Instead, appropriateness of measures must be assessed taking into account, the nature, scope, context and purposes of processing and likelihood and severity of risks. 

11. Did the Court focus on conduct or contract? 

Primarily on conduct (functional influence), but also on contractual elements as strong supporting evidence. 

12. Did it reject the Advocate General’s approach? 

Yes. The AG proposed a differentiated controller/processor analysis; the Court adopted a broader controllership view, increasing the likelihood that platforms fall within GDPR scope. 

13. Is this consistent with EDPB guidance? 

Not entirely. Like the EDPB, the Court emphasised factual control over formal clauses. However, the judgment appears to apply this concept more expansively, potentially lowering the threshold for finding controllership in platform contexts. 

III. GDPR vs safe harbour 

14. Can platforms rely on DSA safe harbour for GDPR breaches? 

No. The Court’s reasoning indicates that intermediary liability exemptions (including their DSA successors) do not shield platforms from GDPR obligations. If a platform qualifies as a controller or joint controller, GDPR duties apply independently of safe harbour. 

15. How did the Court interpret Article 2(4) GDPR? 

The Court interpreted Article 2(4) GDPR (which preserves the application of the e-Commerce framework) narrowly: it does not allow safe harbour rules to limit or override GDPR obligations. Instead, both regimes coexist, but GDPR retains full effect. 

16. Did GDPR “trump” safe harbour? 

In practice, yes. The judgment establishes that GDPR obligations prevail in practice where there is tension; safe harbour cannot be invoked to avoid data protection responsibilities. 

17. Would the outcome differ under the DSA? 

The answer remains uncertain. Some commentators suggest that the outcome could be moderated under the DSA, as it provides clearer rules on the responsibilities of online platforms. Others consider that the central reasoning would remain unchanged, meaning that platforms would still be unable to avoid obligations under data protection law. The relationship between these legal frameworks therefore remains unsettled. 

18. Is Russmedia tied to the old Directive? 

The case was decided under the e-Commerce Directive. While this affects its interaction with the DSA, the Court’s reasoning on GDPR obligations is not limited to that framework and may apply more broadly. 

19. Has the Court created a hierarchy between GDPR and DSA? 

Not explicitly. The Court did not formally establish a hierarchy between the GDPR and the DSA. However, its reasoning suggests that, in situations involving personal data protection, GDPR obligations may carry particular weight. 

IV. Ex ante obligations 

20. Does pre-publication review equal general monitoring? 

The Court determined pre-publication screening of ads as an appropriate technical and organizational measure where they contain sensitive data, including verification of the advertiser’s identity, thereby inferring ex-ante obligations. While it does not formally qualify this as prohibited “general monitoring,” in practice, such obligations may resemble systematic content review. This raises an inherent tension with EU intermediary law that traditionally treated indiscriminate preventive filtering as problematic. 

21. How can platforms detect sensitive data without screening all content? 

In practice, this may be difficult to achieve without some form of systematic screening. The Court states that where the operator knows or ought to know that ads containing sensitive data are likely to appear, it must implement measures, from the design stage, to identify such ads before publication. This strongly implies some form of automated or structured screening of content. 

For businesses, this means higher compliance costs and more complex moderation systems. 

22. Is identity verification now required? 

In the context of an online marketplace, where sensitive data are involved and consent is relied upon, identity verification may be necessary, unless the platform operator relies on any of the other exceptions laid down in Article 9(2)(b) to (j) GDPR. 

This could mean introducing Know-your-customer checks for certain users or content categories, which can have potential frictions with national laws that allow anonymous communications and other fundamental rights questions suggesting freedom of expression and information rights. 

23. What are “appropriate technical and organisational measures”? 

Risk-based safeguards under Articles 24 and 32 GDPR, proportionate to the likelihood and severity of harm. In the instance case, the Court identified such measures to include pre-screening ads and identity verification of the user advertiser. The standard of “appropriate” may now mean more intrusive and proactive than before. 

24. Must platforms prevent downstream copying? 

They must take reasonable technical measures to reduce uncontrolled dissemination but are not strictly liable for all copying. The Court states Article 32 GDPR requires measures to prevent ads containing sensitive data from being copied and unlawfully published on other websites, and to block copies as far as possible. At the same time, Article 32 is risk-based and does not require the elimination of all risks. Thus, platforms are under a “best efforts” obligation to make copying technically difficult, rather than an absolute obligation to guarantee prevention. 

V. Open questions 

25. Is the ruling limited to “online marketplaces”? 

Formally, the case concerns online marketplaces. However, the reasoning is not necessarily limited to that context, as it is based on broader concepts such as joint controllership and platform design. Its application to other types of platforms will depend on how these criteria are interpreted in future cases. 

26. Does it apply only to sensitive data? 

The case centered on special category data, but the controllership logic is not expressly limited to it. 

27. Does it extend to social media? 

Not explicitly addressed, but potentially yes. The logic of joint controllership and platform responsibility could extend to other platforms hosting user-generated content, including social media, depending on their design and level of control. 

28. Is Russmedia consistent with Google Spain? 

Partially. Google Spain is based on an ex post model, where controllership triggers a case-by-case balancing of rights (e.g. via delisting requests). By contrast, Russmedia moves further by imposing ex ante obligations, requiring platforms to take preventive measures such as identifying and filtering certain content before publication. 

29. Is Russmedia consistent with Fashion ID? 

Yes, to a significant extent. Russmedia builds on Fashion ID by reaffirming a broad and functional concept of controllership, where an entity can be a (joint) controller if it exerts influence over the purposes and means of processing, even without directly creating or accessing the data. What Russmedia does is extend this logic, applying it more concretely to platform environments and linking it to detailed, risk-based obligations under the GDPR. 

30. Is this a paradigm shift? 

Debatable. Some commentators describe it as a significant shift, as it moves platforms from reactive notice and takedown toward proactive compliance obligations. Others caution that its impact may be limited or context dependent, especially in light of the DSA. 

VI. Three important takeaways 

31. Does untrue information qualify as personal data under the GDPR?

And why does that matter in practice? Paragraph 53 confirms that “[…] the untrue and harmful nature of data concerning a natural person’s sex life or sexual orientation cannot mean that such data ceases to be classified as ‘sensitive data’ in terms of Article 9(1) of the GDPR”. In practice, this has two key consequences: 

a. Platforms cannot avoid Article 9 obligations by claiming the data is false 
Even fabricated or misleading content must be treated as sensitive personal data, triggering stricter requirements such as a valid legal basis and, in most cases, explicit consent. 

b. It extends GDPR into areas traditionally associated with defamation law 
Individuals may rely on GDPR as an additional legal avenue to challenge harmful false content, increasing potential liability exposure for platforms beyond classic notice and takedown regimes. 

32. Was the Court’s approach intentional or incidental? 

Given how strict the outcome is, some have suggested it might reflect a marginal case or that the Court did not fully anticipate its broader consequences. However, paragraph 104 suggests a more deliberate approach: by referring to the need to limit the “feeling of impunity” the Court indicates an awareness of the effects of its interpretation. 

33. What is the main takeaway for businesses? 

If your model relies on open user uploads, you are now expected to design for detecting misuse more proactively, not just react to it. Russmedia was decided under the e-commerce Directive, the DSA’s predecessor. The Court did not interpret the GDPR alongside the DSA’s updated framework or its more developed safeguards. Future cases may try to reconcile the two regimes or confirm that GDPR obligations effectively override key elements of intermediary liability regime. 

From a practical perspective, it is likely that GPDR-driven risk framework will heavily influence platform design, even where the DSA appears to offer a more balanced framework which could create difficult trade-offs for platforms.