Does a platform lose its liability protection as soon as an algorithm determines who sees what content?

Yes, to a significant extent. In its judgment of June 16, 2026, in the consolidated cases of WebGroup Czech Republic and Coyote System (C-188/24 and C-190/24) The Grand Chamber of the Court of Justice ruled that a platform that uses an algorithm to determine under what conditions, in what manner, and in what order user-generated content is displayed thereby exercises control and can no longer invoke the hosting exemption. For many modern platforms with a recommendation system, this means that the traditional liability shield is much narrower than previously assumed.

The facts

The ruling stems from two French cases that, at first glance, have little in common. The first involves two operators of pornographic websites based in the Czech Republic, WebGroup Czech Republic and NKL Associates. The French regulator, ARCOM, had ordered them to use an age verification system to prevent minors from accessing their sites. The operators challenged this order, arguing, among other things, that France had not notified the European Commission and the Czech Republic of the measures in advance.

The second case involves Coyote System, a French provider of a navigation and driver-assistance service that allows users to warn each other about police checkpoints, such as alcohol and drug tests. A French decree prohibits the transmission of such warnings during certain checks. Coyote System argued that this ban amounted to a general monitoring obligation, which is contrary to the E-Commerce Directive.

In both cases, the French Council of State referred questions to the Court of Justice for a preliminary ruling. The key question was: Do these national rules fall within the scope of the E-Commerce Directive, and if so, was France permitted to impose them on service providers from another Member State?

The decision

The Court addressed two distinct issues: the coordinated territory and the country-of-origin principle, on the one hand, and the hosting exemption, on the other.

The Coordinated Area and the Country of Origin

The Court first confirms that the so-called “coordinated area” referred to in the E-Commerce Directive (Directive 2000/31/EC) must be interpreted broadly. This also includes general and abstract criminal provisions and rules aimed at maintaining public order, public safety, or security, to the extent that they impose requirements on access to or the provision of an information society service. Only those areas that the directive itself expressly excludes, such as taxation, data protection and games of chance are excluded.

It follows from the country-of-origin principle set forth in Article 3 of the E-Commerce Directive that a Member State may not, in principle, restrict the free movement of services from another Member State. A general and abstract penal provision that requires all providers, without distinction, to implement age verification is contrary to that principle. Nevertheless, a Member State may derogate from this on the basis of Article 3(4), if it adopts an individual measure against a specific service, provided that the measure is necessary and proportionate, and the notification procedure to the Commission and the Member State of origin is complied with (except in cases of urgency under Article 3(5)).

According to the Court, ARCOM’s individual cease-and-desist notice to a specific porn site may constitute such a permissible measure, as may a targeted order prohibiting Coyote System from forwarding warnings. It is up to the French court to determine whether all conditions, including the notification, have been met.

The Hosting Exemption and the Algorithm

The most notable part of the ruling concerns Article 14 of the E-Commerce Directive, the hosting exemption. This exemption means that an intermediary that merely stores and transmits user-generated content is, in principle, not liable for what those users post, as long as it is unaware that the content is unlawful and takes prompt action as soon as it becomes aware of it. It is the classic liability shield invoked by platforms such as social media, marketplaces, and video platforms.

Although the French court had not explicitly asked about it, the Court used the question regarding Article 15 (no general duty of supervision) as an opportunity to interpret Article 14 as well.

The Court reiterates that the exemption applies only to a neutral intermediary whose role is purely technical, automatic, and passive. It then clarifies that the two conditions set forth in recital 42 of the Directive—knowledge of and control over the information—are alternative and independent. A provider who exercises control therefore also loses the exemption even if, due to automation, it has no knowledge of the specific content (paragraph 110 of the judgment).

The crux of the matter lies in paragraphs 111 and 112. It is precisely through the algorithm that the operator exercises control: once the operator has used it to determine in advance the conditions under which content will or will not be distributed, it is irrelevant that the operator does not intervene personally. If the algorithm goes beyond merely categorizing and indexing to improve discoverability, and if it determines—in the operator’s interest—under what conditions, how, and in what order of priority the information is displayed, then the operator exercises control. In that case, the operator’s service can no longer be classified as hosting within the meaning of Article 14(1).

In conclusion, the Court rules that Article 15 (no general duty of supervision) offers protection only to those who do fall under the hosting exemption (paragraph 122). Therefore, anyone who loses the exemption immediately loses the protection against a general monitoring obligation as well. For the rest, a specific, clearly defined monitoring obligation remains permissible, such as the targeted prohibition on forwarding police warnings.

Legal analysis and interpretation

A shift in focus from knowledge to control

The major significance of this ruling does not lie in the finding that playing an active role invalidates the exemption. That had already been established since Google France (C-236/08 through C-238/08), L’Oréal/eBay (C-324/09) and YouTube and Cyando (C-682/18 and C-683/18). What is new is the emphasis on monitoring as an independent ground for exclusion, separate from knowledge, and its explicit link to the recommendation algorithm.

Until now, the discussion has centered primarily on whether the platform was actually aware of the unlawful content. From now on, it will matter just as much whether the platform controls which content is displayed, to whom, and in what order. This is a significant shift: a platform can lose its exemption without knowing anything at all about the content in question, simply because its algorithm determines its visibility.

How far does the exception for categorization and indexing extend?

The crux of the entire argument lies in the distinction between, on the one hand, the mere categorization and indexing intended to improve discoverability—which does not affect the exemption—and, on the other hand, the steering of distribution in the operator’s own interest—which does affect it. It is precisely this point that the Court leaves open as the biggest question.

In principle, a chronological or reverse-chronological timeline shows everything, as long as the user scrolls long enough. A recommendation feed, on the other hand, determines whether content appears at all. That difference could well become the dividing line: sorting is not the same as control, but filtering and prioritizing based on what the platform deems most relevant shifts the service toward an editorial decision. Exactly where a court will draw that line remains uncertain for now.

Tensions Over the Digital Services Act

The ruling is based on the E-Commerce Directive, whose liability provisions have since been replaced by the Digital Services Act (Regulation 2022/2065, DSA). Article 14 of the E-Commerce Directive is now Article 6 of the DSA, and Article 15 is Article 8 of the DSA.

At first glance, little has changed: Recital 18 of the DSA applies the same neutrality test and also refers to knowledge or control. Yet there is a tension here. The DSA is based entirely on the assumption that platforms use recommendation systems; it even requires very large platforms to offer a non-profiling option alongside their recommendation feed. A strict reading of this ruling—under which any recommendation system would cause the exemption to lapse—would render the DSA’s carefully balanced content regime largely redundant. That can hardly have been the intention of the EU legislature. The Court could therefore interpret the hosting exemption under the DSA more broadly if that question is brought before it at a later date, particularly since the DSA imposes a comprehensive set of due diligence obligations in exchange for the exemption.

Specifically, what does this mean?

For platform operators with a recommendation system. Assume that a recommendation or prioritization algorithm could jeopardize your claim to the hosting exemption. Identify which parts of your service merely categorize and index content, and which parts control its distribution in your own interest. Anyone who loses the exemption falls back under the standard rules of primary liability: this does not mean you are automatically liable, but it does mean that the question of whether you are acting as a content publisher is once again fully on the table. Document the moderation and removal measures you take so that you can demonstrate that you are not acting unlawfully.

For entitled parties and aggrieved parties. The ruling broadens the possibilities for holding a platform directly liable for content distributed via an algorithm, whether it involves copyright infringement, defamation, or other unlawful content. A platform is generally easier to identify and sue than an anonymous user. Keep in mind, however, that the removal of the exemption does not in itself establish liability: the standard burden of proof and questions of legal classification under Belgian law remain fully applicable.

For providers operating in multiple member states. The ruling confirms that, in principle, a Member State may not impose general, abstract obligations on you outside your Member State of establishment. A targeted, individual measure is possible, but only after the notification procedure with the Commission and your home Member State has been completed. If that notification is missing, the measure cannot be enforced against you.

Frequently asked questions (FAQ)

Will every platform that uses an algorithm now lose its liability protection?
Not necessarily every platform, but the risk is real. According to the Court, problems arise as soon as the algorithm goes beyond mere categorization and indexing and directs distribution in the platform’s own interest, for example through a personalized recommendation feed. A purely chronological timeline is more susceptible to this than a curated feed. The specific assessment is up to the national court.

Does this ruling also apply under the Digital Services Act?
The ruling is based on the E-Commerce Directive, but the substance of the hosting exemption has been incorporated into Article 6 of the Digital Services Act. At first glance, little has changed, although there is debate over whether the DSA, with its extensive due diligence obligations, would lead to a more nuanced outcome.

What is the difference between knowledge and control?
"Knowledge" means that the platform is aware of the specific unlawful content present. "Control" means that the platform, typically through an algorithm, determines whether, how, and in what order content is displayed. Since this ruling, it has been clear that control in and of itself is sufficient to forfeit the exemption, even without knowledge of the content.

Conclusion

With the WebGroup Czech Republic and Coyote System rulings, the Court of Justice has significantly narrowed the scope of the hosting exemption: a platform that uses an algorithm to direct the dissemination of user content in its own interest can no longer invoke this exemption, even if it is unaware of the content. Exactly how far this extends, and whether it will hold up under the Digital Services Act, will have to be determined by case law in the coming years.