(AGENPARL) - Roma, 2 Dicembre 2025 - (AGENPARL) – Tue 02 December 2025 PRESS RELEASE No 150/25
Luxembourg, 2 December 2025
Judgment of the Court in Case C-492/23 | Russmedia Digital and Inform Media Press
Data protection: the operator of an online marketplace is responsible for
the processing of personal data contained in advertisements published on
its platform
In that context, it must in particular identify, before publication, advertisements that contain sensitive data
and verify that the advertiser is actually the person whose data appear in such an advertisement or that the
advertiser has the explicit consent of that person
EU law obliges the operator of an online marketplace to take responsibility for personal data contained in
advertisements published on its platform, in compliance with the GDPR. 1 It must in particular implement
appropriate technical and organisational measures to identify, before publication, advertisements that contain
sensitive data and to verify that the advertiser is actually the person whose data appear in such an advertisement. If
that is not the case, the operator must refuse to publish the advertisement, unless the advertiser can demonstrate
that that person has given his or her explicit consent to publication or that publication is covered by one of the other
exemptions provided for by the GDPR. 2 In addition, the operator must take measures to prevent such
advertisements, when they are published on its platform, from being copied and unlawfully published on other
websites. Furthermore, the operator may not avoid those obligations by relying on Directive 2000/31/EC, 3 which
includes articles 4 relating to situations in which providers of information society services cannot be held liable.
Russmedia Digital, a company incorporated under Romanian law, is the owner of the website www.publi24.ro. The
website is an online marketplace on which advertisements can be published free of charge or for a fee. The
advertisements relate, among other things, to the sale of goods or the provision of services in Romania. On 1 August
2018, an unidentified person published an advertisement on the site, stating that a woman was offering sexual
services. The advertisement contained photographs of the woman, which were used without her consent, along
with her telephone number. The woman considered that the advertisement was untrue and harmful and therefore
asked the website owner to remove it. Russmedia Digital removed the material within an hour of that request.
However, the advertisement at issue had already appeared on other websites, where it remained accessible.
In those circumstances, taking the view that the advertisement infringed her right of personal portrayal, the rights to
honour, reputation and privacy, and the rules relating to the processing of personal data, the woman initiated
proceedings before the Romanian courts. The Court of First Instance of Cluj-Napoca upheld her claim and ordered
Russmedia Digital to pay her € 7 000 euros in respect of non-material damage. On appeal, however, the Specialised
Court of Cluj, found for the company, describing it as a mere hosting service that was not liable for the content
published by its users.
The injured party then lodged an appeal with the Court of Appeal of Cluj. It decided to address the Court of justice
for guidance on the interpretation of EU law, in particular as regards the obligations on the operator of an online
market place under the GDPR and as regards the question of whether such an operator may be relieved of those
obligations on the basis of the exemption from liability provided for by Directive 2000/31 for providers of
information society services. 5
Communications Directorate
Press and Information Unit
curia.europa.eu
In its judgment today, the Court finds that the operator of an online marketplace such as Russmedia Digital is a
controller, within the meaning of the GDPR, 6 of the personal data contained in an advertisement published on
its online marketplace. Even if the advertisement is placed by a user, it is published on the internet and thus made
accessible to internet users only as a result of the online marketplace.
Consequently, the operator of an online marketplace must, before publication of those advertisements and by
means of appropriate technical and organisational measures, identify advertisements that contain sensitive
data, such as the data at issue in the present case, and verify whether the user preparing to place such an
advertisement is the person whose sensitive data appear in it.
If that is not the case, the operator must verify whether the person whose data are being published has given his
or her explicit consent to publication. In the absence of that consent, the operator of an online market place
must refuse publication of the advertisement in question, unless it is covered by one of the other exceptions
provided for by the GDPR. Furthermore, the operator of an online marketplace must endeavour to prevent
advertisements containing sensitive data which are published on its website from being copied and unlawfully
published on other websites. To that end, it must implement appropriate technical and organisational security
measures.
Lastly, the Court states that the operator of an online marketplace cannot avoid its obligations under the GDPR by
relying on the exemption from liability provided for by Directive 2000/31.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which
have been brought before them, to refer questions to the Court of Justice about the interpretation of European
Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the
national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on
other national courts or tribunals before which a similar issue is raised.
Unofficial document for media use, not binding on the Court of Justice.
The full text and, as the case may be, an extract of the judgment is published on the CURIA website on the day of
delivery.
Stay Connected!
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
See Article 9 of the GDPR, which provides for a system of special protection for sensitive data, including data on a natural person’s sex life or sexual