EU’s top court rules that online marketplaces are responsible for processing of data in ads
Summary
The Court of Justice of the European Union (CJEU) has ruled that online marketplaces are data controllers under the GDPR when they publish advertisements containing personal data. Marketplaces must identify and verify, before publication, ads that contain sensitive data and ensure the advertiser is the person shown or has explicit consent.
The ruling arises from a 2018 Romanian case where a marketplace published a fake ad using a woman’s photographs and phone number without consent. Although the ad was removed after a takedown request, it had already spread to other sites. The CJEU’s press release makes clear that operators are responsible for processing personal data in ads and must screen and verify adverts prior to publication.
Key Points
- The CJEU confirmed online marketplaces are data controllers under the GDPR for personal data in adverts.
- Marketplaces must identify ads containing sensitive personal data and verify the advertiser’s identity or consent before publishing.
- The ruling stems from a 2018 Romanian case involving unauthorised use of a woman’s photos and phone number in a fake ad.
- Experts warn this will have wide implications across all 27 EU member states and increase compliance burdens for platforms.
- Critics say the decision could force many small sites to shut down and raise concerns about free expression, anonymous speech and access to information.
Context and relevance
This judgment tightens the accountability of platforms for user-posted content under GDPR, shifting more active duties onto marketplace operators. It intersects with broader regulatory moves across the EU to make digital platforms more responsible for content and data protection. For compliance teams, product owners and small marketplace operators, this sets a legal baseline: passive hosting arguments won’t shield you from GDPR responsibilities when personal data appears in ads.
Author’s take
Punchy: This is a game-changer for online marketplaces. If you build, run or rely on ad-driven sites in the EU, expect immediate operational and legal headaches — and the need for tighter verification workflows.
Why should I read this?
Short answer: because this ruling could force you to rethink how ads are moderated and who pays for compliance. If you run a marketplace, work in privacy or moderate content, it’s not just theoretical — it will probably affect your processes, costs and risk overnight. If you’re curious about platform law and free-speech trade-offs, it’s a must-scan.