Skip to main content
Praxikon

Ruling

Russmedia: an online marketplace operator is controller for personal data in adverts and must check before publication

Date
Status
final
Body
Hof van Justitie van de EU (Grote kamer), X tegen Russmedia Digital SRL en Inform Media Press SRL
Reference
C-492/23, ECLI:EU:C:2025:935

What it is about

Question: is the operator of a classified ads site the controller for personal data in adverts placed by users, and can it rely on the intermediary liability exemptions of the e-Commerce Directive? Ruling: the operator is controller and must, before publication and through technical and organisational measures, identify adverts containing special category data, verify that the advertiser is the data subject and otherwise refuse publication, unless explicit consent or another Article 9(2) exception is demonstrated. It must also take security measures against copying of such adverts to other sites. The e-Commerce Directive exemptions do not apply to these GDPR obligations.

What this means in practice

Platforms, marketplaces and forums where users can post content with other people's personal data must build in a pre-publication check for sensitive content, with identity verification of the poster and a refusal mechanism. Technical measures against scraping and republication are also part of the security duty. The defence that you are merely a neutral conduit does not work under the GDPR.

The GDPR articles concerned

Source: EUR-Lex, arrest C-492/23checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 14

Guidelines8 of 14

Enforcement and fines8 of 12

Legislation in motion6 of 10