ECJ: Responsibility of online marketplace operator for processing data contained in advertisements

In its judgment published today, the European Court of Justice held that the operator of an online marketplace is responsible for the processing of personal data contained in advertisements published on its platform. The operator must identify, before publication, advertisements that contain sensitive data and verify that the advertiser is actually the person whose data appears in such an advertisement or that the advertiser has the explicit consent of that person.

Background

EU law obliges the operator of an online marketplace to take responsibility for personal data contained in advertisements published on its platform, in compliance with the GDPR. It must implement appropriate technical and organizational measures to identify, before publication, advertisements that contain sensitive data and to verify that the advertiser is actually the person whose data appears in such an advertisement. If that is not the case, the operator must refuse to publish the advertisement, unless the advertiser can demonstrate that that person has given his or her explicit consent.

Case in the main proceedings

Russmedia Digital, a company incorporated under Romanian law, is the owner of the website www.publi24.ro. The website is an online marketplace on which advertisements can be published free of charge or for a fee. The advertisements relate, among other things, to the sale of goods or the provision of services in Romania. In terms of content, personal data relating to a natural person was published against her will and without her knowledge for the purpose of advertising sexual services on an online marketplace. The woman considered that the advertisement was untrue and harmful and therefore asked the website owner to remove it. Russmedia Digital removed the material within an hour of that request. However, the advertisement at issue had already appeared on other websites, where it remained accessible.

ECJ judgment

In its judgment today, the ECJ finds that the operator of an online marketplace such as Russmedia Digital is a controller, within the meaning of the GDPR,  of the personal data contained in an advertisement published on its online marketplace. Even if the advertisement is placed by a user, it is published on the internet and thus made accessible to internet users only because of the online marketplace.

Consequently, the operator of an online marketplace must, before publication of those advertisements and by means of appropriate technical and organizational measures, identify advertisements that contain sensitive data, such as the data at issue in the present case, and verify whether the user preparing to place such an advertisement is the person whose sensitive data appear in it. If that is not the case, the operator must verify whether the person whose data are being published has given his or her explicit consent to publication. In the absence of that consent, the operator of an online marketplace must refuse publication of the advertisement in question, unless it is covered by one of the other exceptions provided by the GDPR.

Lastly, the Court notes that the operator of an online marketplace cannot avoid its obligations under the GDPR by relying on the exemption from liability provided for by Directive 2000/31.

Source:

ECJ, decision of 2 December 2025 C-492/23 - Russmedia Digital and Inform Media Press. -ECJ, press release No. 150/25 of 2 December 2025.