Data protection: the operator of an online marketplace is responsible for the processing of personal data contained in advertisements published on its platform

02 December 2025

According to a judgement delivered on 2 December 2025 by the European Court of Justice in the case Russmedia Digital and Inform Media Press, EU law obliges the operator of an online marketplace to take responsibility for personal data contained in advertisements published on its platform, in compliance with the GDPR. It must in particular implement appropriate technical and organisational measures to identify, before publication, advertisements that contain sensitive data and to verify that the advertiser is actually the person whose data appear in such an advertisement. If that is not the case, the operator must refuse to publish the advertisement, unless the advertiser can demonstrate that that person has given his or her explicit consent to publication or that publication is covered by one of the other exemptions provided for by the GDPR.

In addition, the operator must take measures to prevent such advertisements, when they are published on its platform, from being copied and unlawfully published on other websites. Furthermore, the operator may not avoid those obligations by relying on Directive 2000/31/EC, which includes articles relating to situations in which providers of information society services cannot be held liable.

Russmedia Digital, a company incorporated under Romanian law, is the owner of the website www.publi24.ro. The website is an online marketplace on which advertisements can be published free of charge or for a fee. The advertisements relate, among other things, to the sale of goods or the provision of services in Romania. On 1 August 2018, an unidentified person published an advertisement on the site, stating that a woman was offering sexual services. The advertisement contained photographs of the woman, which were used without her consent, along with her telephone number. The woman considered that the advertisement was untrue and harmful and therefore asked the website owner to remove it. Russmedia Digital removed the material within an hour of that request. However, the advertisement at issue had already appeared on other websites, where it remained accessible.

In its judgment today, the Court finds that the operator of an online marketplace such as Russmedia Digital is a controller, within the meaning of the GDPR, of the personal data contained in an advertisement published on its online marketplace. Even if the advertisement is placed by a user, it is published on the internet and thus made accessible to internet users only as a result of the online marketplace.

Consequently, the operator of an online marketplace must, before publication of those advertisements and by means of appropriate technical and organisational measures, identify advertisements that contain sensitive data, such as the data at issue in the present case, and verify whether the user preparing to place such an advertisement is the person whose sensitive data appear in it.

If that is not the case, the operator must verify whether the person whose data are being published has given his or her explicit consent to publication.

Read more about this judgement here.