Online marketplaces liable for third-party ads under GDPR

The European Court of Justice (ECJ) has narrowed the scope of liability for online marketplace operators in a landmark ruling. According to the decision issued on Tuesday, the operator of such a platform is responsible for the processing of personal data contained in advertisements published on its portal. This fundamental liability arises directly from the General Data Protection Regulation (GDPR).

According to the decision in case C-492/23, which primarily concerns the website www.publi24.ro of the Romanian publishing company Russmedia Digital, the operator's obligation as controller is comprehensive: they must take appropriate technical and organizational measures to identify, in particular, advertisements containing sensitive data before publication. This includes, for example, information about sexual life, sexual orientation, and political opinions.

According to the Luxembourg judges, the operator must check whether the advertiser is actually the person whose data is contained in the advertisement. If this is not the case, the service provider must also check whether the data subject has expressly consented to the publication. If no such consent exists and the publication does not fall under any of the other exceptions provided for in the GDPR, such as legitimate interests, the operator must refuse to publish the advertisement. This is crucial, as the processing of sensitive data is generally prohibited unless an applicable privilege applies.

Preventive measures and liability issues

Furthermore, the operator is obliged to implement restrictions to prevent advertisements containing sensitive data published on its platform from being copied and unlawfully distributed on other websites. To this end, they must implement appropriate technical and organizational security measures.

The ECJ has also clarified that the service provider cannot evade these obligations by invoking the E-Commerce Directive. This EU law contains clauses that, under certain circumstances, provide for exemption from liability for providers of information society services. However, the Court emphasizes that responsibility under the GDPR takes precedence and is not undermined by the exemption from liability under the E-Commerce Directive.

Misleading sexual services offered

The ruling stems from a legal dispute in Romania. On the portal publi24.ro, an unknown person had published a misleading advertisement with photos and the phone number of a woman who allegedly offered sexual services. Although Russmedia Digital removed the advertisement within an hour upon request, the publication had already been copied to other websites and remained available there.

The affected woman sued for infringement of her rights to her own image, protection of honor, good reputation, and private life, as well as for violation of data protection regulations. After differing decisions in the lower courts – in one, the company was acquitted of responsibility as a mere hosting provider – the Cluj Court of Appeal referred the case to the ECJ to clarify the obligations under the GDPR.

This has now established that the advertisement was published and made accessible on the internet solely thanks to the platform, which is why the operator must be considered responsible within the meaning of the GDPR. As early as January, the highest EU court ruled that Google must review advertisements placed by third parties as the operator of Google Ads to prevent unlawful phishing attempts from being reported in the future. This falls under the principle of "Störerhaftung" (liability for interference).

(vbr)