The CJEU’s Russmedia decision (C-492/23) and the End of Platform Exceptionalism in EU Data Protection Law

1. Privilegium Minus
The Grand Chamber judgment of the CJEU in Russmedia (Case C-492/23, ECLI:EU:C:2025:935) is surprising in more than one respect.
It is surprising, first, because it states very clearly a legal position that had previously been voiced only hesitantly, if at all, and had never really been absorbed in practice: the liability privileges of the eCommerce Directive and the Digital Services Act have no bearing on the obligations imposed by data protection law, nor on the remedies available under it. Starting from the plain wording of Article 1(5)(b) of the eCommerce Directive, the Court brings the supposedly near-lawless spaces of the platform economy back onto the firm ground of written law. The familiar impression that platforms occupy a zone of practical legal immunity is thereby exposed for what it is.
That impression is not a European invention. It ultimately traces back to Section 230 of the US Communications Decency Act, whose extraordinarily broad immunity for intermediaries shaped the self-understanding of an entire industry. In the slipstream of that controversial American regulatory philosophy, a global platform economy emerged that came to see itself as a comprehensively privileged conduit for third-party content and to treat substantive responsibility as almost alien to its nature. It is therefore unsurprising that the first reactions to Russmedia, including those of experienced US lawyers, were deeply unsettled. Some went so far as to call the decision plainly wrong.
It seems to have been forgotten that European law never granted platforms and other intermediaries any such carte blanche. The Court has now reminded us of what has been the law since 2000: the protection afforded by the eCommerce Directive must not prejudice the fundamental rights protection that follows from the ePrivacy Directive and the GDPR.
The second surprise is how far that protection now reaches in the Court's hands, and it is this point that has startled even experts. The reach is not confined to sensitive data. The Court develops its reasoning on the case of Article 9 data, but the duties it derives rest on Articles 5(2), 24, 25 and 32 GDPR. Those provisions apply to every processing of personal data. What Russmedia sets out is, at its core, a general model of risk management for platforms. The sensitivity of the data determines how intense the required measures are. It does not determine whether those duties exist.
Yet the Court does more than reduce an imaginary edifice of platform privilege to rubble. It reinforces the duties of hosting providers by invoking the protective dimension of the Charter of Fundamental Rights. Effective enforcement of the rights guaranteed by Articles 7 and 8 of the Charter, the right to respect for private life and the right to the protection of personal data, is required by primary law. In this way the Court activates the objective dimension of Union fundamental rights, from which duties of protection arise for both the Member States and the Union legislature. Secondary law that undermines those duties cannot survive scrutiny under the Charter. The liability privileges of the eCommerce Directive must therefore be interpreted consistently with fundamental rights from the outset. In practical terms, they end where the effective protection of personal data begins. Put differently, the relevant "without prejudice" clause does more than preserve the GDPR in the abstract. It prevents displacement and leaves the GDPR in place as the legal framework through which coordination must take place.
2. The Main Proceedings
The Judecătoria Cluj-Napoca, roughly equivalent to a district court, had in many respects anticipated the Court's approach. It awarded EUR 7,000 in damages to a woman whose photographs, together with her name and telephone number, had appeared in an advertisement for sexual services in the "Escort" category, first on publi24.ro and later on other portals as well. The advertisement was deactivated within hours of the claimant's complaint, but it remained accessible through search indexes and caches. The images that could still be found carried the portal's watermark. The consequences for the claimant's life were severe.
The Judecătoria based the claim on violations of the right to one's own image, honour and reputation, and of the rights to data protection and privacy, all resulting from the unlawful processing of personal data. It was not persuaded by the operator's defence that it was merely a third party and a technical interface between the author of the advertisement and the public. Instead, the court focused on the fact that the portal made it possible, unlawfully, to publish "everything about anyone," which could not be accepted. Two things justified holding the platform responsible for the spread of the harmful advertisement, to which it had materially contributed: there were no safeguards for personal data at the upload stage, and there was no protection against onward dissemination by the portal itself or by third parties. The point of attachment for damages was passivity, meaning dangerous inaction where action was required. Neither terms and conditions nor any other unilateral stipulation could relieve the platform of liability under national and European law.
On appeal, the Tribunalul Specializat Cluj set aside the first-instance judgment in 2022. It reasoned that Russmedia was merely a hosting service, was not actively involved, and therefore benefited from the immunity provided by the eCommerce Directive. In its view, the prompt removal of the advertisement spoke against any allegation of passivity. The claimant appealed further. She disputed that the eCommerce Directive could operate as a lex specialis vis-à-vis the GDPR and stressed Russmedia's active role in the processing. The Curtea de Apel Cluj then referred several questions to the Court of Justice.
Those questions set the framework for the Court's ruling. They are of such practical significance that one is tempted to ask why it took twenty-five years for them to reach Luxembourg. Online platforms, and the business models built around them, might well have developed differently had Russmedia carried a case number from the early 2000s.
3. The Questions Referred
In condensed form, the Curtea de Apel Cluj asked four things:
1. Does a reservation of rights in terms and conditions concerning user-generated content deprive a provider of the privileges under Articles 12 to 14 of Directive 2000/31/EC?
2. Is even a hosting provider required to verify the user's identity before publishing an advertisement containing personal data?
3. Does the GDPR require hosting providers, too, to review the content of advertisements before publication?
4. Must controllers adopt technical and organisational measures under the GDPR to prevent the dissemination of unlawful content, and if so, which ones?
Notably, the second and third questions are framed in terms of personal data in general, not only sensitive data.
These questions are highly charged. That is why the proceedings were followed with particular interest, but often from the narrow perspective of media law, trade mark law, copyright law, unfair competition law, or the comparatively younger field of data protection law. This vertical silo thinking is precisely what helps explain why the Court's ruling seemed so surprising. Neither in practice nor in scholarship had there been any sustained discussion of the relationship between data protection law and platform privileges. This was never really a case of one body of law displacing another. It was a problem of coordination between overlapping regimes that both claim relevance for the same facts.
4. The Advocate General's Opinion
In February 2025, Advocate General Szpunar, in his Opinion in Russmedia (Case C-492/23, ECLI:EU:C:2025:68), tried to find a way out of a dilemma that had been neglected for far too long: the uneasy relationship between data protection law and the eCommerce Directive. He proposed that the hosting privilege should also apply to data protection duties, provided the provider remained a neutral hosting service. In his view, this was still the case here despite the grant of usage rights. He further argued that the platform was merely a processor. It therefore had no duty to assess the legality of advertisements or to protect against their dissemination, and at most had to implement technical and organisational measures to maintain data security. At the very end, however, he conceded that the hosting provider's responsibility for the advertising data could not be denied where the advertisements came from registered users.
The Court did not follow that approach on any of the decisive points.
5. Russmedia as a Data Protection Textbook
The Grand Chamber seems almost to have set itself the task of writing a textbook chapter on responsibility under data protection law, and it succeeded. Russmedia is now the reference point for determining roles and responsibilities under the GDPR. By contrast, the highly practical question of the relationship between the eCommerce Directive and the GDPR takes up comparatively little space in the judgment, and there are good reasons for that. The Court structures its dense reasoning in a clear sequence: facts, system, and subsumption. Not every data protection judgment of the Court follows that structure. Here it is immensely helpful, because it gives national courts what may be, for the first time, a complete roadmap for data protection disputes.
The Court begins with the essence of the case, the harmful advertisement, and classifies its contents step by step, by reference to the legislation, as personal data. The brief excursion on the objective and subjective dimensions of identifiability was not strictly necessary, but it is useful in borderline cases. The fact that the judgment does not mention Case C-413/23 P (ECLI:EU:C:2025:645) suggests that the practical significance of that decision may have been overstated.
Referring to the recent case law on health data (Case C-667/21, ECLI:EU:C:2023:1022), the Court points to the sensitivity of the categories of data listed in Article 9(1) GDPR and to the particularly serious interference with fundamental rights that their processing entails. It also refers to case law recognising the importance of derived and indirectly sensitive information, including political opinions (Case C-204/21, ECLI:EU:C:2023:442). From this it derives the heightened protection the law requires for such data, whether the underlying information is true or false.
This point matters beyond Article 9. The data actually uploaded (photographs, a name, a telephone number) are, taken individually, entirely ordinary personal data. They became sensitive only through their context, here the "Escort" category. Whether data are "sensitive" is therefore often decided not by the data themselves but by how they are combined, framed and disseminated. A platform cannot reliably know in advance which ordinary data will turn into sensitive data in its environment. That is the first indication that the duties the Court develops cannot sensibly be limited to Article 9 data. They must be built into the architecture for all personal data that pass through it.
The next step follows immediately. Referring to the Grand Chamber's leading judgment on the scope of Article 9 GDPR (Case C-184/20, ECLI:EU:C:2022:601), the Court makes clear that publishing an advertisement on an internet portal is processing within the meaning of Article 4(2) GDPR. This classification has nothing to do with the sensitivity of the data. The judgment continues in the same detailed and systematic manner, which is one reason it reads like a textbook.
a) Roles and Responsibilities
The doctrinal centre of the ruling begins around paragraph 56, where the Court identifies the key question: who is responsible for the harmful advertisement? The unknown platform user, the platform operator, or both jointly? The Court proceeds methodically. First, the concept of controller must be interpreted broadly to ensure effective protection for data subjects. Second, any natural or legal person who exerts influence over a processing operation in its own interest, and thereby participates in determining its purposes and means, may be a controller. Definitions were never the problem. What had long been missing were clear criteria that work in practice.
The Court then takes time to explain joint controllership, a concept that in practice is often about as popular as joint and several liability. Unlike joint and several liability, however, joint controllership cannot be arranged away by contract. It arises solely from what the actors involved actually do with the data. As the Court emphasises by reference to more recent case law (Case C-683/21, ECLI:EU:C:2023:949), the threshold for this shared responsibility is very low. Responsibility need not be equal in weight, nor must it exist in every phase. It may vary from one stage to another and must always be assessed in the specific circumstances. Anyone familiar with the case law knows the teleological frame: starting from the need for a high level of protection, the Court tends to treat almost any assistance, encouragement or participation in a processing operation as enough to establish responsibility. Article 4(7) GDPR thus clearly emerges as a rule of attribution, and as such it applies to any personal data, not only to special categories.
The Court has little difficulty affirming the advertiser's responsibility. It then turns to the more interesting question of the platform's responsibility. In paragraph 65 it states that the platform's existence was the conditio sine qua non for publication of the advertisement. The core point is clear: a platform becomes a controller under data protection law when it publishes personal data for commercial or advertising purposes and, in doing so, goes beyond providing a merely neutral service.
The next step begins with the finding that a platform which does not process solely, or even primarily, on behalf of the advertiser is itself a controller. The Court then examines the licence clause addressed in the first question. That clause alone already takes the platform a long way towards controllership. Through it, the platform helped determine the purposes of publication, and therefore of the processing itself. Nor does the Court let the platform escape by describing the advertisement as user misconduct. If the platform is set up so that anonymous advertisements can be posted without verification and without consent, harmful advertisements are not a misuse of the system. They are one of the uses for which the system was made available. Such advertisements materialise risks for data subjects, and the platform operator must answer for those risks precisely because its own purposes are defined so broadly and flexibly.
The means of processing follow naturally. In substance, the Court states that providing the platform already amounts to participating in determining those means. Such a determination exists where a natural or legal person:
• materially influences the collection and transmission of personal data,
• shapes the processing through its technical configuration in line with its own business objectives, or
• makes personal data publicly accessible online in an organised and aggregated way.
A platform participates in determining the essential means of publication where it:
• defines the parameters for dissemination according to the target audience,
• determines how the content is presented or how long it remains visible,
• defines the categories in which the information is structured, or
• organises the ranking on which visibility depends.
None of these criteria depends on the type of data processed. They describe the platform's architecture, not the content.
These statements are of major practical significance. Parameters for dissemination according to the target audience cover the full range of targeting mechanisms that a platform offers to users or implements itself. Examples include geolocation functions, demographic filters, behavioural segmentation based on earlier searches or click histories, and contextual assignment to thematically related content. It remains open whether merely providing such filtering tools is already enough to count as participating in determining the means of processing, even where the advertiser does not actively use them.
There are strong arguments for that view. By implementing such functions, the platform pre-structures the space of possible processing and thereby creates the conditions for targeted use of data. The Court's teleological approach, aimed at effective protection for data subjects, points towards an expansive reading. On the other hand, one may object that merely supplying a technical tool, used on the documented instructions of the advertiser, does not yet amount to the platform's own influence over the concrete processing operation. Read too broadly, the concept could leave the role of the processor functionally meaningless.
The fourth criterion poses equally serious challenges for platforms, because organising ranking means algorithmically controlling visibility. Platforms that use relevance algorithms weight advertisements by criteria such as recency, click-through rate, advertiser reputation, or willingness to pay for premium placement. That weighting decides whether an advertisement appears on the first page of results or disappears into the obscurity of later pages. Through recommendation systems and ranking tools, platforms directly influence the reach and reception of the personal data published. Given how broad the platform's own commercial purposes are, this is enough to push it over the threshold into full data protection responsibility.
b) A "Neutral Role" after Russmedia?
One question remains. Could the Court not simply have found that Russmedia had abandoned its "neutral role" within the meaning of YouTube and Cyando (Joined Cases C-682/18 and C-683/18, ECLI:EU:C:2021:503, paragraph 105), and so fell outside the eCommerce Directive's privileges from the outset?
The Court's two most recent hosting judgments suggest that it could have. They also show why it did not need to.
In Coyote (Joined Cases C-188/24 and C-190/24, WebGroup Czech Republic and Others, ECLI:EU:C:2026:492), the Court restated that Article 14 of the eCommerce Directive protects only a provider whose conduct is merely technical, automatic and passive, meaning one that has neither knowledge of nor control over the content it stores (paragraph 109). It then added two clarifications. First, knowledge and control are alternative and independent of each other. A provider can lose its neutral role through control alone, without ever becoming aware of what its users have stored. Second, the Court defined control by reference to the platform's algorithms. Merely categorising and indexing information to make it more accessible does not amount to control. Control does exist where the algorithm determines, in the operator's own interest or that of its service, under what conditions, how and in what order of priority information is or is not disseminated (paragraph 112).
One month later, in AGCOM (Case C-421/24, ECLI:EU:C:2026:[…]), the Court adopted that test expressly (paragraph 38) and turned to knowledge. A video platform that enters into a commercial partnership with a content creator, and for that purpose reviews the essential content of the creator's channel, acquires knowledge of that content. It can then no longer claim to be a neutral intermediary, even if the review only served to check compliance with the platform's own rules. This builds on the long-standing principle that an operator which optimises the presentation of content or promotes it does not play a neutral role (Case C-324/09, L'Oréal and Others, ECLI:EU:C:2011:474, paragraph 116).
Measured against these two judgments, Russmedia's position as a neutral host looks weak. The operator used its licence clause to reserve extensive rights to use, copy and distribute the advertisements. It sorted them into categories such as "Escort", determined how they were presented and how long they stayed visible, and did all this in pursuit of its own commercial purposes. Under Coyote, the decisive question is whether this went beyond mere categorisation and amounted to determining, in the operator's own interest, the conditions, manner and priority of dissemination. Under AGCOM, a platform that structures its commercial relationship with users around their content, and claims rights over that content, points in the same direction. Either route would probably have led to the loss of the neutral role.
The Court nevertheless did not need either route, for two reasons. First, the questions referred had been framed very clearly as questions of principle, and the Court could not simply sidestep them. Second, and more fundamentally, under Article 1(5)(b) of the eCommerce Directive the answer to the neutrality question has no bearing on data protection. Neutral or not, the platform remains subject to the GDPR. The neutrality test decides whether a provider can be held liable for unlawful third-party content. Controllership decides which duties the provider bears for its own processing of personal data. Read together, the three judgments therefore exert two distinct pressures on the hosting privilege. Coyote and AGCOM narrow it from within, by widening what counts as knowledge or control. Russmedia takes data protection out of its reach entirely.
The criteria largely converge. Organising ranking, determining presentation, and setting the parameters of dissemination in the platform's own interest are the hallmarks of control under Coyote. Under Russmedia, they are the hallmarks of participation in determining the essential means of processing. The criteria that establish data protection responsibility can therefore also serve as indicators that a platform has lost its neutral role within the meaning of Recital 42 of the eCommerce Directive, which limits protected intermediation to activity "of a mere technical, automatic and passive nature." Coyote (alerts about roadside checks) and AGCOM (gambling advertising) show that the neutrality test already works across sector-specific regulation. The convergence may therefore reach well beyond data protection law, into fields such as trade mark law, youth protection and unfair competition law.
The overlap is not complete, though, and the gap is telling. Under Coyote, mere categorisation does not amount to control. Under Russmedia, defining the categories in which information is structured is already enough to participate in determining the essential means of processing. A platform may therefore still be a neutral host for liability purposes and at the same time be a controller with the full set of duties under the GDPR. Data protection responsibility starts earlier than the loss of the hosting privilege. It also covers all personal data the platform processes, not only content that is unlawful.
Nor is the ruling any less significant because Article 89 of the Digital Services Act repealed Articles 12 to 15 of the eCommerce Directive and replaced them with the now fully harmonised provider privileges in Articles 4 et seq. DSA. The neutrality requirement continues in Article 6 DSA, read with Recital 18 DSA, so the reasoning in Coyote and AGCOM carries over. Just as under Article 1(5)(b) of the eCommerce Directive, read together with Article 94 GDPR, Article 2(4)(g) DSA expressly excludes Union rules on the protection of personal data from the DSA's scope. There is no sign that the legislature intended to undo, or even modify, the long-standing relationship between intermediary privileges and data protection law that the Court has now applied so forcefully. More broadly, such clauses do not positively resolve the relationship between overlapping digital regimes. They prevent displacement and require coordination through the GDPR's own concepts and standards.
Returning to the case itself, the Court comes back to the licence clause and holds that it matters not only for determining the purpose. Its wording also gives concrete indications that the platform materially influenced the processing and therefore helped determine its means.
The Court thus denies platform operators any retreat into passive infrastructure. Whoever builds the stage, raises the curtain, and profits from admission cannot credibly claim to have nothing to do with the performance. In data protection law, responsibility does not turn on authorship of the content. It turns on control over the infrastructure through which the content is disseminated.
c) Accountability and Compliance
Against this background, the Court explains, in strikingly detailed and highly didactic fashion, the internal logic of the controller's duties under the GDPR. Its starting point is the purpose of the high level of protection required by primary law, which is plainly relevant to current debates about simplification and deregulation. It begins with the data protection principles in Article 5(1) GDPR, compliance with which is a precondition for the lawfulness of any processing. It then explains how Articles 5, 6 and 9 GDPR relate to each other, before turning to Article 5(2) GDPR, which it presents in a new light: as the keystone of the controller's obligations.
Accountability, the Court explains, does not stand alone. It is the foundation for Article 24 GDPR, which gives it concrete form. Together, these provisions create a twofold set of duties for the controller. On the one hand, there is the express duty of accountability. On the other, there are preventive compliance duties of the kind the Court had already identified in earlier case law (Case C-129/21, ECLI:EU:C:2022:833). The judgment draws a systematic line from the data protection principles and ordinary documentation all the way to the proactive design of processing infrastructures through privacy engineering. This is also where the GDPR's structural openness to coordination is most visible: its open-textured standards serve as points of entry through which sector-specific regulatory value judgments can shape the data protection analysis.
It is important to note that this framework is not a special regime for sensitive data. Article 5(2), Article 24, Article 25 and Article 32 GDPR attach to every processing of personal data. In the Court's reasoning, Article 9 is not the source of the duties to prevent, review and protect. It only raises the level the controller must meet.
In paragraph 89, the Court brings Article 25 GDPR into this concept of accountability and compliance by treating data protection by design and by default as part of the controller's preventive duties. The burden of proving compliance with those duties lies with the controller. The Court concludes that even default settings must ensure that personal data are not made accessible to an indefinite number of persons without the data subject's active intervention. This standard comes directly from the wording of Article 25(2) GDPR, and it applies to all personal data, not only to special categories. At the level of system design, the controller must be able to show which privacy-enhancing technologies are built into the architecture, how data flows are structured, and which safeguards are embedded in the code. The Court thus demands end-to-end auditability. Compliance must be traceable from the first design choice to the final user action.
The Court then applies this framework to the publication of Article 9 data by the advertiser and the platform. Both joint controllers must adopt concrete technical and organisational measures so that sensitive data are processed in a way proportionate to the risks for data subjects. The Court stresses that publishing such data may have irreversible effects, because once data are public, deletion may be practically impossible. That threatened loss of control is especially serious for sensitive data, but it is not unique to them. Publishing a name, a photograph, or a telephone number to an unlimited audience also causes loss of control. As the facts of the case show, publication may be precisely the step that turns ordinary data into sensitive data. A platform that allows anonymous advertisements actively increases this risk, which is why running such a platform can become a dangerous business model. Anyone who runs an anonymous classified advertising platform acts, at the very least, with gross negligence in relation to the legal infringements that can be expected to occur.
The Court therefore states, with particular emphasis, that the controller has a legal duty, already at the design stage of the service, to implement preventive technical and organisational measures under Article 25 GDPR. Those measures must make it possible to review advertisements and to ensure that the personal data they contain are processed lawfully. A merely reactive system of the kind familiar from intermediary law in other fields does not satisfy the protective mandate flowing from Articles 7 and 8 of the Charter. The duty of lawful processing under Article 5(1)(a) and Article 6 GDPR applies to every personal datum in an advertisement. Pre-publication review is therefore not, in principle, limited to Article 9 content. What varies with the risk is how deep and how strict that review must be.
The Court then argues, entirely convincingly from the structure of the GDPR itself, that a controller may process sensitive data only with the data subject's consent, which presupposes that this person actually gave the consent. Without identity verification, however, the controller cannot provide the proof of consent that Article 5(2) GDPR requires. Nor can it properly fulfil the information duties under Articles 13 and 14 GDPR. That failure is fatal, because fairness, transparency and lawfulness must all be satisfied together. Both the advertiser and the platform are therefore under a duty to verify identity.
This reasoning does not depend on Article 9 GDPR. Whenever a platform publishes personal data about third parties, it must be able to show a legal basis under Article 6 GDPR and to inform the data subject under Article 14 GDPR. A controller that does not know who provided the data, or whether that person was entitled to do so, cannot meet either duty. For sensitive data, the consent requirement makes verification unavoidable. For other data, the same accountability logic applies, scaled to the risk that the publication creates.
The technical and organisational measures adopted must also be genuinely capable of limiting the risks of offering a publication mechanism. In a particularly striking passage, the Court states that "limits must be set to the impression that one may consider oneself safe from punishment." This adds a general preventive dimension to the GDPR's structure of duties. Identity verification becomes a tool for steering behaviour: it is meant to encourage users who post advertisements to comply with the law. The reasoning is coherent, because Articles 24 and 25 GDPR do not impose merely reactive duties. They impose a duty of proactive design. The controller is not supposed to wait until infringements occur. It must build an environment in which infringements are less likely from the outset, and that applies whatever category of data is concerned.
If identity verification shows that the advertiser is not the person whose sensitive data appear in the advertisement, there is no verifiable consent from the data subject. In the absence of such consent, or of another exception under Article 9(2) GDPR, the processing is prohibited. The platform operator must then refuse publication. This is mandatory, not optional. In practice, it reverses the platform logic that has long prevailed. Until now, the basic model was to publish first and review only after a complaint. The Court now establishes a duty to review before publication. The operator becomes a gatekeeper that may release sensitive content only once its lawfulness under data protection law has been positively established. The advertiser must therefore prove that the processing is lawful, for example by presenting a declaration of consent from the data subject. If it cannot, the advertisement must stay blocked.
For platform operators, this means a fundamental redesign of their business processes: review before publication instead of takedown after it. Because the underlying duties under Articles 5(2), 24 and 25 GDPR apply to all personal data, this is not limited to obviously sensitive content. It extends to every publication of third-party data whose risk profile calls for prior control.
d) Risk Management and Protection Against Dissemination
The list of operational consequences does not end there. In answering the fourth question, the Court turns again to appropriate technical and organisational measures, this time from the angle of technically limiting the spread of unlawful content. The starting point is that third parties copied the harmful advertisement without any action on the part of the platform. The Court then analyses the platform's sole responsibility for this later phase of processing. It begins with Article 32 GDPR and makes clear that sensitive personal data published on the internet also fall within its protective scope. They are therefore subject to the obligation to implement measures ensuring a level of security appropriate to the risk.
The word "also" deserves attention. Article 32 GDPR is not a provision about sensitive data. It is the general security obligation for all personal data. The Court applies it to the special categories without suggesting that its protective scope stops there. The publication of ordinary personal data is equally covered.
Once again the Court speaks at a level of abstraction that is highly relevant to operational data protection practice. The GDPR, it explains, establishes a risk management system meant to limit risks realistically, even if it cannot eliminate them entirely. Article 32, read together with Article 24 GDPR, is designed to prevent risks to data subjects as far as possible. The often misunderstood risk-based approach of the GDPR therefore means an obligation to minimise risk. It is not a licence to knowingly expose others to risk. The measures required must always be assessed in light of the specific processing operation.
The central criterion for assessing risk is the sensitivity of the data processed, because processing such data may be a particularly serious interference with the rights guaranteed by Articles 7 and 8 of the Charter. Sensitivity, however, is a criterion within the risk assessment, not a condition for it. The risk-based approach works like a scale, not a switch: it applies to all processing, and the sensitivity of the data moves the required level of protection up or down. Anyone who makes personal data freely available on the internet directly creates the risk of a loss of control that robs the rights granted by the GDPR of their practical effect. For sensitive data this risk is at its most acute, but it exists for any data. What is lost is lost.
This high level of risk gives rise to a duty to consider all currently available technical measures capable of preventing the copying and replication of online content. In earlier case law, the Court had required de-indexing by search engines once a legal basis had ceased to exist (Case C-131/12, Google Spain and Google, ECLI:EU:C:2014:317). The present judgment goes further and requires preventive protection against dissemination. At the current state of the art, that may include:
• server-side access restrictions,
• authentication requirements,
• rate limiting,
• bot detection against automated scraping,
• content security policies that prevent embedding on third-party sites,
• digital watermarking to identify the source, and
• tools such as Nightshade or Glaze designed to interfere with onward use in machine learning systems.
The Court does not demand a guarantee of success. It demands documented and serious engagement with the available protective options and their implementation in proportion to the risk. Which of these measures is required in a given case depends on the risk profile of the specific processing. The duty to carry out that assessment, however, exists for every platform that makes personal data publicly accessible.
The clarification in paragraph 123, that the mere occurrence of unlawful processing does not by itself prove the measures taken were inadequate, may at first sound reassuring. On closer inspection it is a mixed blessing. What it really makes clear is that the controller bears the burden of proving the measures were adequate, and must be able to disclose its entire compliance architecture and show that it works.
e) Not Only Sensitive Data: Risk Management as the General Rule
It would be a serious misreading of Russmedia to treat it as a judgment about special categories of personal data alone. The facts of the case involved Article 9 data, and the Court's operative answers are expressed with that in mind. The legal basis of the duties it develops, however, is general:
• Article 5(2) GDPR (accountability) applies to every processing operation.
• Article 24 GDPR requires appropriate measures for every processing operation, taking into account "the risks of varying likelihood and severity for the rights and freedoms of natural persons."
• Article 25(2) GDPR requires, for all personal data, that by default they are not made accessible to an indefinite number of persons without the individual's intervention.
• Article 32 GDPR requires security appropriate to the risk for all personal data.
• Articles 6 and 14 GDPR require a demonstrable legal basis and information of the data subject whenever third-party data are published.
The Court's reasoning therefore amounts to a general model of platform risk management. Sensitivity determines how intense the measures must be: how thorough the pre-publication review is, how strict the identity verification, how robust the protection against dissemination. It does not determine whether those duties exist at all.
There is also a practical reason why platforms cannot limit their compliance architecture to sensitive data. As the facts of Russmedia show, the boundary between ordinary and sensitive data is often drawn only by context. A name, a photograph and a telephone number are harmless in a directory and devastating in an "Escort" category. Under the case law on indirectly sensitive data (Case C-184/20, ECLI:EU:C:2022:601), it is enough that sensitive information can be inferred. A platform that set up preventive safeguards only for data it recognised as sensitive at the moment of upload would systematically miss exactly the cases in which the harm arises from context. The design obligation under Article 25 GDPR must therefore address the architecture as a whole.
For platform operators, the lesson is that a compliance programme for "sensitive content" is not enough. What is required is a risk assessment covering all personal data the platform publishes, with safeguards graduated by risk and documented in a form that satisfies Article 5(2) GDPR.
f) The GDPR Remains Untouched
As already noted, the Court deals only briefly with the relationship between the eCommerce Directive and the GDPR, and rightly so. The wording of the legislation left it little room for manoeuvre. From a legal-historical point of view, it is striking that the Court needed no sophisticated teleological argument to reach its conclusion. It simply had to apply the statutory text. Younger lawyers may reasonably wonder how anyone could ever have read Article 1(5)(b) of the eCommerce Directive as meaning anything other than that data protection obligations are unaffected by the intermediary privileges in Articles 12 to 15. The wording of the legislation and earlier case law had already made the point clear. Russmedia does not invent a new principle. It restores one that had been ignored.
Concepts that have shaped the law of new media for decades are therefore likely to be reassessed in light of Russmedia. A legal practice organised in narrow specialisms can no longer ignore the data protection dimensions of media law, trade mark law, copyright, unfair competition and criminal law without incurring serious liability risk. Debates about the scope of the media privilege under Article 85 GDPR, which national legislatures and courts have in some cases quite plausibly drawn too broadly from the perspective of Union law, are likely to return with force. So too are attempts to use the broad reach of the concept of personal data to bypass the old and laborious notice-and-takedown architecture. Secondary liability of intermediaries and upload filters may return in a new doctrinal setting.
The effectiveness of Union law remedies is therefore a strong argument for pursuing data protection-based enforcement wherever that path is open. In Quirin Privatbank (Case C-655/23, ECLI:EU:C:2025:655), the Court made clear that data subjects have a right to lawful processing of their personal data. That proposition has significant consequences for national remedies. Long-established restrictions in domestic procedural law cannot stand where they frustrate the effective judicial protection required by Union law. This has particular force in the platform context, because Russmedia widens the circle of actors who may be controllers under data protection law. It thereby opens the door to claims against platform operators for access, notification and injunctive relief.
One final point is particularly striking. In a single subordinate clause, the Court punctures one of the central myths of platform law by asking the obvious question: why should platforms be treated as exceptional at all? Being able to rely on the liability exemptions in the eCommerce Directive cannot interfere with the rules of the GDPR, which apply to such operators just as they apply to any other economic actor. Platforms are not legal exotica. They must submit to the same basic discipline as everyone else, for all the personal data they process and not only for the most sensitive. For people whose data are misused on online platforms, that is very good news. For platform operators of every kind, it is a clear instruction: adapt or leave the field.

Article provided by INPLP member: Peter Hense (Spirit Legal, Germany)