EU court ruling ties algorithmic control to loss of hosting exemption for online services

The European Union’s highest court ruled last month that an online service can lose a key liability shield if it uses an algorithm to decide how user information is rebroadcast — language that is now drawing scrutiny well beyond the case that produced it.

In a judgment delivered June 16, the Court of Justice of the European Union said a provider cannot rely on the EU’s hosting exemption when it exercises control over user information by determining the conditions, method and priority of its redistribution. Digital rights groups and some legal analysts say that wording is broad enough that future litigants could try to apply it to mainstream platform recommender systems.

That matters because the hosting exemption, set out in Article 14 of the EU’s E-Commerce Directive, is one of the legal foundations of online platforms in Europe. It generally protects hosting services from liability for user content when they play a neutral role. Critics of the ruling, including the Electronic Frontier Foundation, argue that the court’s language could narrow that protection beyond the facts of the case, potentially raising new questions about ranking and recommendation tools used across the internet.

The ruling came in joined cases referred by France’s Conseil d’État, the country’s highest administrative court, which sent questions to Luxembourg on March 6, 2024. The references were received by the CJEU the next day.

One case, C-188/24, involved French age-verification rules for pornographic websites. The other, C-190/24, involved Coyote System, a driving-assistance and geolocation service that collected and relayed user alerts about roadside checks. The Grand Chamber said member states may, subject to the conditions in the E-Commerce Directive, require age verification for pornographic sites and prohibit rebroadcasting information on certain roadside checks.

The most consequential part of the judgment for tech law came in the court’s reading of Article 14. In a press release, the court said: “the operator of an information society service cannot be exempted from its liability for the information stored and rebroadcast over which it has control. That is the case where the operator determines, by means of an algorithm, under what conditions, how and in which order of priority that information is or is not rebroadcast.”

The judgment itself used similar language. In paragraph 122, the court said that “where, by means of an algorithm, the operator of an information society service … determines … under what conditions, how and in which order of priority that information is or is not broadcast … it exercises control over that information, with the result that it cannot be classified as a provider … within the meaning of Article 14(1).”

Put plainly, the court linked algorithmic ranking and distribution decisions to “control” over the information being shared. In those circumstances, the provider is not treated as a neutral host for purposes of the Article 14 safe harbor.

The case did not directly concern a large social network, video platform or search engine. The Coyote dispute was about a service that took user reports and redistributed them through a navigation-alert system. Advocate General Maciej Szpunar, an adviser to the court whose opinions are influential but not binding, described that process in September 2025 as creating “a new ‘information layer’” through algorithmic processing.

The June ruling was also a preliminary ruling, meaning the CJEU interpreted EU law but did not itself issue the final decision on the French measures. France’s Conseil d’État must now apply that interpretation to the underlying disputes. The court also reaffirmed that when national measures affect providers established in other EU countries, member states must respect the E-Commerce Directive’s procedural requirements, including notification and coordination rules, except in urgent cases.

The broader legal backdrop is important. The E-Commerce Directive, and now the Digital Services Act, generally preserve conditional immunity for hosting user content and bar governments from imposing general monitoring obligations on intermediaries. The DSA kept those basic protections in place even as it added transparency and due-diligence rules for recommender systems and the largest platforms. Earlier CJEU case law, including the 2021 YouTube and Cyando ruling, has also focused on when a service moves beyond a passive hosting role.

That is why the wording in the Coyote judgment is getting close attention. Critics such as the Electronic Frontier Foundation say the court did not target social media platforms explicitly, but that its reasoning could be cited in future cases involving recommendation and ranking systems. If courts read it broadly, they argue, platforms could face stronger incentives to moderate or remove content to reduce liability risk.

For now, the clearest point is narrower than some of the reaction around it: the CJEU has created a precedent tying algorithmic control over rebroadcasting to loss of the hosting exemption. How far that principle extends beyond the specific French disputes will now be tested by national courts in later cases.