Clémentine Baldon
Retour à la liste
On 16 June 2026, the Court of Justice of the European Union (CJEU) issued a much-awaited judgment in Joined Cases C-188/24 WebGroup Czech Republic and C-190/24 Coyote System on key provisions of the “e-commerce” Directive.
The joined cases, examined by the Court, concern two proceedings challenging the legality of two French decrees under EU law:
- The first required publishers of pornographic websites to implement age verification mechanisms to prevent minors from accessing their content (the “age verification obligation”).
- The second prohibited providers of geolocation driving assistance services (“geolocation providers”) from rebroadcasting information transmitted by their users on roadside checks in France, such as randomised alcohol and drug testing (the “rebroadcasting ban”).
In both cases, the claimants argued that French law was in breach of the “country of origin” principle enshrined in Article 3 of the e-commerce Directive, which prohibits Member States from imposing obligations on information society services (“ISS”) established in other Member States, when these fall within the “coordinating scope” of the Directive. In addition, in the rebroadcasting ban case, the claimant argued that the decree also infringed on Article 15 of the e-commerce Directive by imposing a general obligation on geolocation providers to monitor the information they host.
In this context, the French Council of State (“Conseil d’Etat”) referred questions to the CJEU to gauge the validity of the challenged provisions. The ruling of 16 June 2026 sheds light on Member States’ power to regulate ISS established in other Member States within the country of origin principle (1) as well as the limits of the exemption of liability for hosting platforms and States’ power to require them to remove illegal content (2).
1. Member States’ leeway to regulate ISS within the country of origin principle
The Court first rules that the “coordinated field” of the Directive covers all measures from Member States relating to the activity of an ISS, except for the areas explicitly excluded from the scope of the e-commerce Directive. This includes national criminal law and general provisions pursuing objectives of public policy, security and safety (para. 52-66). The CJEU concludes that both the age verification obligation and the rebroadcasting ban fall within the “coordinated field”.
The Court then recalls the scope of the country of origin principle and the conditions under which Member States may derogate from this principle (1.1). It then analyses whether these conditions are satisfied by the disputed French measures (1.2).
1.1 The country of origin principle under the e-commerce Directive and the derogations to the principle
Article 3(2) of the e-commerce Directive lays down the so-called “country of origin” principle which prohibits Member States from restricting the free movement of ISS established in other Member States. This means that, in principle, ISS are regulated solely in the Member State where they are established and cannot be regulated by other Member States.
Derogations to the country of origin principle are subject to strict conditions.
First, under Article 3(4)(a), measures may only derogate from Article 3(2) if:
- They are necessary for public policy, including the protection of minors, or for public health, public security or consumer protection reasons,
- They are taken against a given ISS which prejudices or presents a serious and grave risk of prejudicing these objectives, and
- They are proportionate to the stated objectives.
Second Article 3(4)(b) sets a procedural requirements to make a prior, unsuccessful, request to the Member State in which the ISS is established to take itself the measures and a prior notification to the Commission and that Member State.
1.2 Application of the country of origin principle to the challenged measures
The CJEU finds that the age verification obligation and the rebroadcasting ban each impose requirements on ISS, including those established in other Member States. They, therefore, constitute a restriction on the freedom to provide ISS, within the meaning of Article 3(1) and (2) of the e-commerce Directive (§§ 74-77).
Turning to possible derogations under Article 3(4), the Court rules that both measures pursue a public policy objective (§ 82) and may be considered proportionate (§§ 94-96), so that they meet the first and third conditions of Article 3(4)(a).
As regards the second substantive condition (ie. that the measure be taken against a given ISS which prejudices the measure’s objective), the CJEU refers to its recent rulings, notably, its judgement in Google Ireland, where it adopted a narrow interpretation of the criteria by excluding ‘general and abstract measures aimed at a category of given information society services described in general terms and applying without distinction to any provider of that category of services”.
In this regard, the Court’s response is somewhat ambivalent. On the one hand, the CJEU holds that French criminal law prohibiting the broadcasting of certain messages likely to be seen by minors is a “general and abstract legislation” covering notably ISS established in other Member States so that it cannot satisfy the second condition of Article 3(4)(a) (§85).
On the other hand, however, the Court rules that, in the present case, the age verification obligation and rebroadcasting ban may be regarded as targeting a given, specific ISS so that they are not ‘abstract or general’. This conclusion is based on the structure of these measures, which provide that an administrative authority must give formal notice individually addressed to specific ISS providers (§86). The Court concludes that “formal individual notices to public communication service providers broadcasting pornographic content or decisions prohibiting the operators of a given service from rebroadcasting certain information, may constitute measures taken against a given information society service, within the meaning of Article 3(4)(a) of Directive 2000/31”.
Key takeaways: a narrow path to regulating online platforms established in other Member States
This new ruling will come as a relief to some Member States as the Court’s highly restrictive approach to the derogation in the Google Ireland and subsequent cases left them largely powerless to protect public interest objectives, including minors’ fundamental rights from online platforms’ practices.
It also provides clarification as to which regulatory approaches may be acceptable within the country of origin principle. This will impact other national legislations, including, for example, a recently adopted French law regulating certain practices of fast fashion online platforms.
Nevertheless, to remain within the narrow limits of the derogation, Member States must establish complex and burdensome mechanisms requiring administrative authorities to translate generally applicable laws into individualised provider-specific notices, in addition to complying with other procedural requirements, including a prior request to the State of origin to adopt the measure itself and prior notification to that State and the Commission. Some uncertainty also persists regarding the enforcement of general national criminal laws in the event of non-compliance by online platforms with administrative notices.
2. Scope of online platforms’ exemption of liability and obligations to remove illegal content
In the rebroadcasting ban case, the Court was also asked to assess whether the prohibition for geolocation providers to rebroadcast illegal information shared by users infringes on Article 15(1) of the e-commerce Directive, by forcing geolocation providers to monitor the information on their sites so as not to include certain road check data.
To answer this question, the CJEU first examines whether geolocation providers may benefit from the hosting liability under Article 14(1), while providing important clarifications on the application of that exemption to online platforms using algorithms (2.1). The CJEU then assesses whether, in any event, Member States may request platforms to remove illegal content. (2.2).
2.1 The liability exemption for hosting platforms
Under Article 14(1) of the e-commerce Directive: “Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.”
After establishing that operators concerned by the rebroadcasting ban would most likely fall under the ‘hosting’ scope of Article 14(1), the CJEU turns to the conditions applicable for hosting platforms to benefit from the exemption.
In this regard, the Court recalls that condition (a) has to be understood as a situation where a service provider has neither knowledge nor control over the information they store but where their activity is “[…] of mere technical, automatic and passive nature.”
Indeed, according to a well-established CJEU case law, online platform operators may lose the benefit of the liability exemption when they play an active role that gives them knowledge of or control over the illegal content (§§ 108-110).
For the first time, the CJEU specifies that an operator is deemed to have control over the information it stores where it “determines, in its own interest or that of its service, under what conditions, how and in which order of priority that information is or is not broadcast as part of that service” (§122).
This new ruling sets a key precedent for holding online platforms liable for the content they sort and display when they use algorithms in their own interest.
Article 14 of the e-commerce Directive has since been replaced by article 6 of the Digital Service Act (“DSA”). However, given the almost identical wording of the two provisions, the Court’s findings on the limits of platforms’ liability exemption are likely to remain relevant under the DSA, although this interpretation will undoubtedly be subject to debate and potential challenge.
2.2 Possibility for national authorities to request platforms to remove illegal content
The Court adds that in any event, even where article 14(1) and, therefore article 15(1) apply, this cannot prevent an administrative authority from requiring that a provider terminate or prevent an infringement or a Member State to put in place procedures to remove or disable access to illegal information (§119).
In this regard, the Court recalls its Glawischnig-Piesczek ruling, pursuant to which an order to remove specific illegal content, does not constitute ‘general monitoring’ if the provider can use automated tools without independently assessing all content (§120).
The Court indicates that, in the present case, according to the referring court, geolocation operators may comply with the rebroadcasting ban, without having to acquaint themselves with the content of the messages transmitted by their users. Thus, the rebroadcasting of this information may be automatically prevented by the operators.
The Court concludes that article 14(1) and article 15(1) of the e-commerce directive do not preclude a Member State from prohibiting, on grounds of public policy, security or safety, online platforms, from rebroadcasting information relating to certain roadside checks.
