In WebGroup Czech Republic & NKL Associates (C 188/24) and Coyote System (C 190/24), the Court of Justice of the EU issued a ruling which addresses two politically sensitive issues: age verification for online content and restrictions on user-generated information services.
The cases arose in the context of French laws requiring pornographic websites to implement age verification systems, and driving assistance apps to stop rebroadcasting user reports of certain roadside checks.
Service providers established in other Member States challenged the French laws, arguing that France had breached the “country of origin” principle under the E-Commerce Directive.
Country of origin principle considered
The Court reaffirmed that the coordinated field under the E-Commerce Directive is broad, covering essentially all requirements governing access to and operation of information society services. This means that, as a starting point, only the law of the Member State of establishment applies.
However, the judgment confirms that host Member States can impose their own rules on foreign providers, and those rules may restrict cross-border services, provided strict conditions are met, including legitimate objectives such as public policy, protection of minors, or public security, proportionality, and compliance with procedural safeguards (notably notification to the Commission and the home Member State, except in urgent cases).
Age verification requirements
The Court accepted that mandatory age verification for adult content may be justified on public policy grounds, specifically the protection of minors. Notably, the Court did not question the legitimacy of age assurance as such, but focused on whether measures are necessary and proportionate, and if they are applied through proper procedural channels.
Algorithmic control
Under the E-Commerce Directive, hosting providers benefit from safe harbour protection where they do not have knowledge of illegal content, and do not exercise control over it.
The Court held that this exemption does not apply where the provider exercises control via algorithmic curation. Specifically, a provider loses hosting status if it determines “under what conditions” content is shared, “how” content is presented, and “in which order of priority” it is rebroadcast.
The judgment effectively confirms that ranking, prioritisation, and content optimisation can amount to “control”, and many platforms relying on sophisticated recommendation systems may struggle to claim neutrality.
The Court also emphasised procedural discipline. Before imposing restrictions on a foreign provider, a Member State must ask the home Member State to act, and notify the Commission and that State of its intended measures, except in urgent cases.
